Cloudanix VulnDB

CVE-2024-5187

High · 8.8

CVSS

8.8

EPSS

1.2%

Published

Jun 6, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in a popular machine-learning library lets attackers secretly replace important files on a computer when a tainted data package is processed, which could let them take control of the system or destroy files.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Inadequate path validation during tar extraction in the download_model_with_test_data function permits absolute or traversal paths, enabling arbitrary file overwrite on the host filesystem.

Why it matters to the business

Attackers can replace critical configuration, credential, or binary files, resulting in system takeover, data loss, service outages, and costly incident response.

How an attack unfolds

An attacker crafts a tar archive containing files with absolute paths such as /home/user/.ssh/authorized_keys, hosts or delivers the archive, and induces a victim application to invoke download_model_with_test_data on the malicious tar; extraction then silently overwrites target files, enabling follow-on remote code execution or persistence.

How to fix it

Upgrade the ONNX package to a version containing path-sanitization fixes for tar extraction, replace calls to download_model_with_test_data with hardened alternatives, and enforce allow-listing of extraction destinations.

How to confirm the fix worked

Verify the installed ONNX version against the patched release, execute unit tests that supply tar archives with absolute paths and confirm extraction is rejected or confined, and review application logs for extraction operations on untrusted inputs.

Typical attack path

  1. Craft malicious tar archive embedding absolute or traversal paths
  2. Host or deliver the archive via model repository or direct download
  3. Victim application invokes download_model_with_test_data on the archive
  4. Extraction writes attacker-controlled content to arbitrary filesystem locations
  5. Attacker leverages overwritten files for remote code execution or denial of service

How to detect it

Review application and system logs for invocations of download_model_with_test_data, correlate with subsequent writes to sensitive paths such as SSH directories or executable locations, and inspect tar extraction events that reference absolute paths.

What your security team should do

  • Immediately inventory all systems using ONNX 1.16.0 and schedule upgrades
  • Disable or sandbox any use of download_model_with_test_data until patched
  • Add runtime monitoring for unexpected writes to sensitive paths during model downloads
  • Educate developers on safe handling of untrusted archives

The record

A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.

Affected packages

Ecosystem Package Introduced Fixed
PyPI onnx 0 1.16.2
PyPI onnx 0 1.17.0
Debian:11 onnx 0 No fix
Debian:12 onnx 0 No fix
Debian:13 onnx 0 No fix
Ubuntu:22.04:LTS onnx 0 No fix
Ubuntu:24.04:LTS onnx 0 No fix
Ubuntu:24.10 onnx 0 No fix
Ubuntu:25.04 onnx 0 No fix
Ubuntu:25.10 onnx 0 No fix

Related vulnerabilities