YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
PoC: Path traversal via MANIFEST.json requirementsFile in TorchServe → arbitrary file to pip -r (CWE-22)
Loading a crafted TorchServe model archive (.mar) passes an arbitrary server file to pip install -r:
the requirementsFile field from the archive's MANIFEST.json is joined to the model directory without
containment, then used as the pip -r target.
Root cause
frontend/server/src/main/java/org/pytorch/serve/wlm/ModelManager.java:296-297, 320/342:
Path requirementsFilePath =
Paths.get(model.getModelDir().getAbsolutePath(), requirementsFile).toAbsolutePath();
...
commandParts.add("-r"); commandParts.add(requirementsFilePath.toString()); // pip install -r <path>
requirementsFile is a raw attacker-controlled string from MANIFEST.json inside the .mar. It is joined
to the model dir with no canonicalization / containment check, then passed verbatim as -r <path> to
pip install. The isValidDependencyPath() guard validates the model directory, not
requirementsFilePath. A value like ../../../../etc/anything escapes the model dir, so pip parses an
arbitrary server file as a requirements list (contents leak via pip error output; if the attacker can also
plant a writable requirements file on a reachable path, this escalates to arbitrary package install = RCE).
Reachability
Runs only when installPyDepPerModel=true (default false) — a documented production option for per-model
dependency installation. Distinct sink from the configFile YAML-read traversal (different file, different
impact).
Reproduce
python3 mar_requirementsfile_traversal_poc.py
# MANIFEST requirementsFile = ../../etc_pip_requirements.txt
# requirementsFilePath = .../mar_reqfile_demo/etc_pip_requirements.txt
# escaped model_dir? = YES - path traversal
# resulting command = pip install -U -t <modeldir> -r .../etc_pip_requirements.txt
Fix
Canonicalize requirementsFilePath and verify it stays within modelDir (call isValidDependencyPath on
it, not just the model dir); reject any requirementsFile containing .. or an absolute path.