NVIDIA Triton Inference Server Path Traversal Vulnerability Allows Arbitrary File Read
Overview
A high-severity path traversal vulnerability was identified in the NVIDIA Triton Inference Server. The vulnerability allows an attacker with privileges to upload models to a model repository to read arbitrary files from the server's filesystem. The flaw exists in the way Triton parses the model configuration file (`config.pbtxt`). An attacker can craft a model configuration where the `name` or platform field contains path traversal sequences (e.g., `"../../../../etc/passwd"`). When the Triton server polls the repository and loads this malicious model configuration, it concatenates the path without proper sanitization. This leads to the server attempting to read a file from an unintended location. Successful exploitation allows the attacker to access sensitive files, such as system configuration files, private keys, or credentials stored on the server, leading to significant information disclosure. This could be a precursor to a more complex attack, such as privilege escalation or lateral movement within the MLOps infrastructure. The issue was discovered by an internal security audit and affects several recent versions of the Triton server.
Affected Systems
Testing Guide
1. Create a new model directory in your Triton model repository. 2. Inside the model directory, create a `config.pbtxt` file with the following content: `name: "../../../../../../../../etc/os-release" platform: "ensemble" ` 3. Create a dummy `1/model.dummy` file inside the model directory. 4. Start the Triton server and monitor its logs. If the server is vulnerable, you will see an error message indicating it failed to load a model or file from a path like `/path/to/repo/../../../../../../../../etc/os-release`, confirming the traversal.
Mitigation Steps
1. Upgrade the NVIDIA Triton Inference Server to version 24.05 or newer. 2. As a temporary workaround, implement strict access controls on the model repository, allowing only trusted users to upload or modify model configurations. 3. Run the Triton server process as a low-privilege user with restricted filesystem access (chroot jail or container) to limit the impact of a successful traversal attack. 4. Implement an automated scanning process for model configuration files (`config.pbtxt`) to detect and block suspicious path traversal sequences before they are loaded by the server.
Patch Details
Patched in NVIDIA Triton Inference Server version 24.05. The patch introduces stricter path validation and normalization for all model configuration files.