CVE-2023-31036
📋 TL;DR
NVIDIA Triton Inference Server has a path traversal vulnerability when launched with the --model-control explicit option. Attackers can exploit this via the model load API to access files outside intended directories, potentially leading to code execution or data compromise. This affects administrators who use the non-default explicit model control configuration.
💻 Affected Systems
- NVIDIA Triton Inference Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise including remote code execution, privilege escalation to root/admin, complete data exfiltration, and persistent backdoor installation.
Likely Case
Information disclosure of sensitive files, denial of service by corrupting critical files, or limited code execution within the Triton service context.
If Mitigated
No impact if the vulnerable configuration is not used or proper access controls restrict the Triton service account.
🎯 Exploit Status
Exploitation requires access to the model load API endpoint. No public exploit code has been observed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.09 and later
Vendor Advisory: https://nvidia.custhelp.com/app/answers/detail/a_id/5509
Restart Required: Yes
Instructions:
1. Download Triton Inference Server version 23.09 or later from NVIDIA NGC. 2. Stop the current Triton service. 3. Install the updated version. 4. Restart the Triton service with your configuration.
🔧 Temporary Workarounds
Avoid explicit model control
allDo not use the --model-control explicit option. Use default or other model control modes.
Remove '--model-control explicit' from Triton startup command
Restrict Triton service account
linuxRun Triton with minimal privileges and restrict filesystem access.
chmod 750 /path/to/triton/models
setfacl -m u:triton:rx /path/to/triton
🧯 If You Can't Patch
- Disable the model load API endpoint or restrict access to trusted IPs only
- Implement strict filesystem permissions and run Triton with a non-privileged service account
🔍 How to Verify
Check if Vulnerable:
Check if Triton is running with --model-control explicit option and version is below 23.09Check Version:
tritonserver --versionVerify Fix Applied:
Confirm Triton version is 23.09 or higher and verify the path traversal is blocked in testing📡 Detection & Monitoring
Log Indicators:
- Unusual model load requests with path traversal patterns (../)
- Failed model load attempts with suspicious paths
- Access to files outside model repository
Network Indicators:
- HTTP POST requests to /v2/repository/models/{model}/load with path traversal payloads
SIEM Query:
source="triton" AND ("model-control explicit" OR "../" IN request_path)