Improper Access Control in Hugging Face Hub Allows Private Model Access
Overview
A significant access control vulnerability was discovered in the Hugging Face Hub platform, which could allow unauthorized users to access private models. The issue stemmed from a misconfiguration in an API endpoint responsible for handling large file uploads (LFS) within model repositories. While the primary repository access endpoints correctly enforced user permissions, this specific LFS endpoint failed to re-verify if the authenticated user was a member or owner of the target private repository before processing a file operation. An attacker who was authenticated to the Hugging Face Hub (with any valid account) could craft a direct API request to this endpoint, specifying the namespace and repository name of a known private model. By initiating a file operation, the attacker could trick the system into granting them temporary, but effective, read access to the model's files, including weights, tokenizer configurations, and potentially sensitive training data embedded in the repository. This allowed for the exfiltration and theft of proprietary, fine-tuned models and datasets that were intended to be private.
Affected Systems
Testing Guide
1. This vulnerability was patched by the Hugging Face team. It is no longer possible to test for this specific exploit. 2. You can verify the security of your private models by ensuring that only authorized users listed under your repository's 'Settings > Collaborators' can clone or access the model via the API.
Mitigation Steps
1. **No User Action Required:** The vulnerability was in the Hugging Face platform itself and was patched server-side. Users do not need to take any action on their models. 2. **Rotate Tokens (Precautionary):** As a best practice, it is recommended to periodically rotate Hugging Face access tokens, especially if you have used them in CI/CD systems. 3. **Audit Repository Access:** Regularly review who has access to your private organization and model repositories on Hugging Face and remove any unrecognized or unnecessary users.
Patch Details
The vulnerability was identified and patched by the Hugging Face security team. The fix was deployed globally and involved adding the correct authorization checks to the affected API endpoint.