YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
CNTK Arbitrary Code Execution (ACE) via Malicious Model (UDF Deserialization)
This repository contains a Proof of Concept (PoC) and security analysis for a critical Arbitrary Code Execution (ACE) vulnerability in the Microsoft Cognitive Toolkit (CNTK) v2.
Vulnerability Overview
The vulnerability resides in the User Defined Function (UDF) deserialization path. When a model is loaded via cntk.Function.load(), the library parses metadata from the .model file. In the Python bindings (bindings/python/cntk/internal/__init__.py), the module and class fields are extracted from the model's dictionary and passed directly to an unsafe exec() call without sanitization.
Vulnerable Code Sink
# bindings/python/cntk/internal/__init__.py
exec("from {} import {}".format(module, cls))
Proof of Concept & Evidence
1. Analysis & Reachability
Source code analysis of Source/CNTKv2LibraryDll/Function.cpp and Serialization.cpp confirms that attacker-controlled metadata in a .model file's dictionary flows directly into the Python callback.
2. Malicious Model Construction
The file malicious.model is a crafted CNTK model generated by gen_model.py. It contains a malicious UDF dictionary structure designed to exploit the exec() sink.
3. Verification (Simulation)
High-fidelity simulation of the CNTK C++-to-Python callback mechanism confirms that the metadata extracted from the crafted model successfully triggers arbitrary command execution (e.g., os.system('touch pwned')).
Remediation
The vulnerability is remediated by replacing the unsafe exec() and eval() calls with importlib.import_module and getattr().
import importlib
try:
module_obj = importlib.import_module(module)
cls_obj = getattr(module_obj, cls)
factory = getattr(cls_obj, deserialize_method, None)
except (ImportError, AttributeError, Exception):
factory = None
Disclaimer
This repository is for research and validation purposes only. CNTK is an archived project; users are advised to migrate to supported frameworks like PyTorch or TensorFlow.