ONNX Path Traversal Vulnerability via Symlink
Overview
A critical path traversal vulnerability has been identified in the Open Neural Network Exchange (ONNX) format, specifically affecting versions prior to 1.21.0. The vulnerability arises from improper handling of symbolic links (symlinks) during the loading or processing of ONNX models. When an attacker can control the creation of a symlink within a directory that ONNX is processing, they can craft a symlink that points to a location outside the intended model directory or user-provided paths. ONNX's file handling mechanisms, when dereferencing this malicious symlink, do not sufficiently validate the target path. This allows an attacker to read arbitrary files from the host system, including sensitive configuration files, system secrets, or user data, effectively bypassing intended access controls. This could lead to significant information disclosure and further compromise of the system.
Affected Systems
Testing Guide
1. Create a malicious ONNX model file or directory structure containing a symlink. 2. The symlink should point to a sensitive file outside the model's expected directory (e.g., `/etc/passwd`). 3. Attempt to load this crafted ONNX model using a vulnerable version of ONNX Runtime. 4. Check if the application attempting to load the model crashes or if the content of the sensitive file is accessible or logged.
Mitigation Steps
- Ensure ONNX Runtime is updated to version 1.21.0 or later. - Implement strict file system access controls to limit the directories where ONNX models are loaded from. - Sanitize or validate any user-provided paths and filenames before they are used in conjunction with ONNX model loading. - Avoid loading ONNX models from untrusted or potentially compromised sources.
Patch Details
1.21.0