OpenMed RCE via Malicious Hugging Face Model Loading
Overview
OpenMed versions prior to 1.5.2 are susceptible to a critical remote code execution (RCE) vulnerability stemming from insecure handling of user-supplied model names within its PII privacy-filter component. The privacy-filter dispatcher relies on overly permissive substring matching when processing the `model_name` parameter. This allows an unauthenticated attacker to craft a `model_name` value, such as `attacker/foo-privacy-filter-bar`, which bypasses intended security checks and can trigger the loading of external models. Specifically, it can be exploited to load models from Hugging Face repositories where the `trust_remote_code` option is enabled. An attacker can then host a malicious model repository containing custom Python code, often specified within the `auto_map` field of `config.json` or `tokenizer_config.json`. When OpenMed loads this malicious model, it executes the custom code with the same privileges as the OpenMed service process, granting the attacker full control over the affected system.
Affected Systems
Testing Guide
1. Attempt to load a custom model using a specially crafted `model_name` parameter that includes path traversal sequences or characters commonly used in malicious filenames (e.g., `../`, `attacker/`). 2. If possible, set up a mock Hugging Face repository with a `config.json` or `tokenizer_config.json` containing an `auto_map` pointing to an executable script. 3. Observe if OpenMed successfully loads the model and executes the custom code. Monitor system logs for any unexpected process execution or outbound network connections originating from the OpenMed service. 4. Verify that OpenMed versions below 1.5.2 are vulnerable, while version 1.5.2 and above are not.
Mitigation Steps
- Update OpenMed to version 1.5.2 or later. - Implement strict input validation on the `model_name` parameter to prevent arbitrary path traversal or unexpected characters. - Configure Hugging Face's `trust_remote_code` to `False` by default for all model loading operations within OpenMed, or explicitly vet all loaded models. - Restrict network access for the OpenMed service to only known and trusted model repositories. - Use a sandboxing or containerization solution for the OpenMed service to limit the impact of a successful code execution.
Patch Details
OpenMed 1.5.2