YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
PoC: Path traversal via MANIFEST.json configFile in TorchServe .mar loading (CWE-22)
Loading a crafted TorchServe model archive (.mar) reads an arbitrary server file: the configFile field
from the archive's MANIFEST.json is joined to the model directory without containment and opened/parsed
as YAML.
Root cause
frontend/archive/src/main/java/org/pytorch/serve/archive/model/ModelArchive.java:225-227:
File configFile = new File(modelDir.getAbsolutePath(), manifest.getModel().getConfigFile());
...
ArchiveUtils.readYamlFile(configFile); // opens + parses the path as YAML
getConfigFile() returns a raw attacker-controlled string from MANIFEST.json inside the .mar. It is
joined to the model dir with no canonicalization / .. containment check, then opened. A value like
../../../../etc/passwd escapes the model directory, so TorchServe reads an arbitrary file (its contents
flow into the ModelConfig object / error logs). The only .. guard in the file (:57) validates the
download URL, not MANIFEST.json fields read after extraction; the ZipUtils zip-slip guard is a separate
code path. The Python mirror ts/.../service.py:38-40 (os.path.join(model_dir, model_yaml_config_file))
has the same gap. Reachable on the normal model-load path (downloadModel -> load -> getModelConfig), no
opt-in. Distinct from the ShellTorch CVE-2023-43654 (management-API SSRF) cluster.
Reproduce
python3 mar_configfile_traversal_poc.py
# MANIFEST configFile = ../../SECRET_server_file.yaml
# resolved configFile path = .../mar_traversal_demo/SECRET_server_file.yaml
# escaped model_dir? = YES - path traversal
# readYamlFile() leaked contents of SECRET_server_file.yaml: db_password: hunter2 ...
# RESULT: ARBITRARY FILE READ CONFIRMED
A real trigger is a .mar whose MANIFEST.json model.configFile is ../../../<server path>.
Fix
Canonicalize the resolved configFile and verify it stays within modelDir before opening; reject any
configFile containing .. or an absolute path.