CVE-2024-0815: PaddlePaddle Command Injection RCE Vulnerability

CVE-2024-0815 Overview

CVE-2024-0815 is a command injection vulnerability in PaddlePaddle 2.6.0, an open-source deep learning framework maintained by Baidu. The flaw resides in the paddle.utils.download._wget_download function, where attacker-controlled input bypasses filtering logic and reaches the underlying shell. An authenticated local attacker who can influence the URL passed to the download utility can execute arbitrary operating system commands. Successful exploitation yields high impact to confidentiality, integrity, and availability, and can pivot beyond the vulnerable component's security scope. The issue is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Attackers with local access to a PaddlePaddle 2.6.0 workflow that calls _wget_download can execute arbitrary shell commands under the runtime user, compromising machine learning pipelines and training data.

Affected Products

PaddlePaddle 2.6.0
Machine learning pipelines that invoke paddle.utils.download._wget_download
Downstream applications bundling the vulnerable PaddlePaddle release

Discovery Timeline

2024-03-07 - CVE-2024-0815 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0815

Vulnerability Analysis

The vulnerability exists in paddle.utils.download._wget_download, a helper that fetches remote artifacts using the system wget binary. The function applies a filter intended to reject shell metacharacters before invoking a subprocess. Attackers can bypass this filter by supplying a crafted URL string that survives sanitization but is interpreted by the shell as multiple commands. Because the download helper is used during model and dataset acquisition, exploitation is reachable from any code path that passes untrusted URLs to the utility. The Huntr bounty report (bounty details) documents the filter bypass technique.

Root Cause

The root cause is improper neutralization of shell metacharacters when constructing the wget command line. The sanitization routine does not fully account for alternate quoting, encoded characters, or option-injection primitives that wget itself supports, such as --use-askpass or --output-document. The command is executed through a shell interpreter rather than a safe argv list passed directly to the process, allowing metacharacters that pass the filter to be reinterpreted at execution time.

Attack Vector

Exploitation requires local access and low privileges on a system running PaddlePaddle 2.6.0. An attacker supplies a malicious URL, either directly through a script that calls the download helper or indirectly by influencing configuration files, dataset manifests, or model registry entries consumed by a PaddlePaddle workflow. When the download function processes the URL, the crafted payload is passed to the shell, and the injected commands run with the privileges of the PaddlePaddle process. The changed scope indicates that compromise can extend beyond the PaddlePaddle runtime to other components on the host.

No verified public exploit code is available. The Huntr bounty submission describes the filter-bypass technique conceptually without publishing a weaponized payload.

Detection Methods for CVE-2024-0815

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running PaddlePaddle, particularly shells (/bin/sh, bash) or wget invocations with unusual arguments.
Outbound network connections from ML training hosts to attacker-controlled infrastructure immediately following a call to a download helper.
New or modified files in home directories, cron paths, or SSH authorized_keys created during a PaddlePaddle job.

Detection Strategies

Instrument process-creation telemetry on hosts running PaddlePaddle and alert on Python processes spawning shells or writing to sensitive paths.
Deploy static analysis or software composition analysis to flag any project pinning paddlepaddle==2.6.0 in requirements files, container images, or lockfiles.
Inspect ML pipeline logs for URLs containing shell metacharacters, backticks, $() sequences, or double dashes that map to wget options.

Monitoring Recommendations

Monitor for wget executions containing option flags that write to disk, such as --output-document, --post-file, or --use-askpass.
Track modifications to dataset manifests, model registry entries, and configuration files that feed URLs into PaddlePaddle utilities.
Audit privileged execution contexts, such as CI/CD runners and Jupyter kernels, that invoke PaddlePaddle download routines on behalf of multiple users.

How to Mitigate CVE-2024-0815

Immediate Actions Required

Inventory all systems, containers, and virtual environments running PaddlePaddle 2.6.0 and prioritize remediation on multi-tenant or internet-facing hosts.
Restrict access to code paths that invoke paddle.utils.download._wget_download with user-supplied URLs until an upstream fix is applied.
Run PaddlePaddle workloads under dedicated, least-privileged service accounts to limit the blast radius of command execution.

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Consult the Huntr bounty report and the PaddlePaddle project's official release notes for the latest remediation guidance. Upgrade to a PaddlePaddle release later than 2.6.0 that addresses the filter-bypass condition once available.

Workarounds

Replace calls to _wget_download with a wrapper that fetches URLs using Python-native libraries such as urllib or requests, avoiding shell invocation entirely.
Validate URLs against a strict allowlist of trusted hosts and reject any input containing shell metacharacters, whitespace, or option prefixes before passing them to download utilities.
Execute PaddlePaddle jobs inside sandboxed containers with read-only file systems, seccomp profiles, and egress filtering to constrain post-exploitation activity.

bash

# Configuration example: pin a safe version and constrain runtime privileges
# requirements.txt
paddlepaddle!=2.6.0

# Run containers with reduced capabilities and no shell escalation
docker run --read-only --cap-drop=ALL --security-opt no-new-privileges \
  --user 10001:10001 paddlepaddle/paddle:<patched-tag>