CVE-2024-7776
📋 TL;DR
A path traversal vulnerability in the ONNX framework's download_model function allows attackers to overwrite arbitrary files by exploiting malicious tar archives. This affects users of ONNX versions up to 1.16.1 who download models from untrusted sources, potentially leading to remote code execution.
💻 Affected Systems
- ONNX (Open Neural Network Exchange)
📦 What is this software?
Onnx by Onnx
⚠️ Risk & Real-World Impact
Worst Case
Remote command execution with the privileges of the ONNX process, potentially leading to full system compromise.
Likely Case
Arbitrary file overwrite in the user's directory, enabling data corruption, privilege escalation, or persistence mechanisms.
If Mitigated
Limited to file corruption in isolated environments with strict file permissions and no sensitive data in accessible directories.
🎯 Exploit Status
Exploitation requires the user to download a malicious tar file, but the vulnerability itself is straightforward to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.2 and later
Vendor Advisory: https://github.com/onnx/onnx/security/advisories
Restart Required: No
Instructions:
1. Update ONNX using pip: 'pip install --upgrade onnx>=1.16.2'. 2. Verify the update with 'pip show onnx'. 3. No restart required as it's a library update.
🔧 Temporary Workarounds
Validate tar file contents
allManually inspect and validate tar file contents before extraction in the download_model function.
# Custom validation script required - no single command
Use trusted model sources only
allRestrict model downloads to verified, trusted repositories and sources.
🧯 If You Can't Patch
- Implement strict file permissions to limit write access to critical directories.
- Monitor and audit file system changes in directories where ONNX downloads models.
🔍 How to Verify
Check if Vulnerable:
Check ONNX version with 'pip show onnx' or 'python -c "import onnx; print(onnx.__version__)"'. If version is <=1.16.1, the system is vulnerable.Check Version:
python -c "import onnx; print(onnx.__version__)"Verify Fix Applied:
After updating, verify version is >=1.16.2 using the same commands.📡 Detection & Monitoring
Log Indicators:
- Unexpected file writes outside expected model directories
- Tar extraction errors or warnings in application logs
Network Indicators:
- Downloads of tar files from untrusted sources to ONNX applications
SIEM Query:
source="application_logs" AND ("tar extraction" OR "download_model") AND ("path traversal" OR "../")