CVE-2024-0817 Overview
CVE-2024-0817 is a command injection vulnerability in the IrGraph.draw function of PaddlePaddle 2.6.0. The flaw allows a local authenticated attacker to execute arbitrary operating system commands by supplying crafted input that reaches an unsafe shell invocation. PaddlePaddle is an open-source deep learning framework widely used for model training and inference. Exploitation requires local access with low privileges and no user interaction, and successful exploitation compromises confidentiality, integrity, and availability of the host running the affected Python process. The issue is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command.
Critical Impact
Local low-privileged users can execute arbitrary commands in the context of the PaddlePaddle process, enabling code execution and lateral movement on ML training hosts.
Affected Products
- PaddlePaddle 2.6.0
- The IrGraph.draw method within the PaddlePaddle framework
- Python environments importing paddle 2.6.0 for graph visualization workflows
Discovery Timeline
- 2024-03-07 - CVE-2024-0817 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0817
Vulnerability Analysis
The vulnerability resides in the IrGraph.draw function, which renders PaddlePaddle intermediate representation (IR) graphs to image files. The function accepts user-controlled parameters, such as file paths or output names, and passes them to an underlying shell command without proper sanitization or neutralization of shell metacharacters. When an attacker supplies input containing command separators or shell operators, the injected payload executes in the same process context as PaddlePaddle. Because ML training environments frequently run under privileged service accounts and have access to datasets, model artifacts, and cloud credentials, command execution here can lead to data theft or pivoting into adjacent infrastructure. Refer to the Huntr bounty listing for the vulnerability report.
Root Cause
The root cause is improper neutralization of special elements in a command string [CWE-77]. IrGraph.draw constructs a command to invoke an external rendering utility (Graphviz dot) and concatenates user-supplied arguments into the command line without escaping. The call is dispatched through a shell interpreter, which parses metacharacters such as ;, |, &, and backticks as control operators rather than literal filename characters.
Attack Vector
An attacker with local access and permission to invoke Python code that uses PaddlePaddle can call IrGraph.draw with a malicious save_path or filename argument. This scenario is realistic in shared Jupyter environments, multi-tenant ML platforms, and CI/CD pipelines where untrusted notebooks or scripts execute. Because the attack vector is local and requires low privileges, it maps to insider abuse or exploitation via a chained vulnerability that supplies attacker-controlled arguments to IrGraph.draw.
The vulnerability manifests when unsanitized input reaches a shell invocation inside IrGraph.draw. See the Huntr bounty listing for reproduction details.
Detection Methods for CVE-2024-0817
Indicators of Compromise
- Unexpected child processes spawned by python or Jupyter kernel processes that import paddle, especially shells such as /bin/sh, bash, or cmd.exe.
- Shell metacharacters (;, |, &&, backticks) appearing in filename arguments passed to Graphviz dot invocations.
- New files, outbound network connections, or credential access originating from PaddlePaddle worker processes.
Detection Strategies
- Enable process-lineage telemetry on ML training hosts and alert on dot, sh, or bash executions whose parent is a PaddlePaddle Python process.
- Perform static analysis of notebooks and pipeline code to flag calls to IrGraph.draw with dynamic or externally sourced arguments.
- Correlate PaddlePaddle version fingerprints (paddle.__version__ == '2.6.0') with process execution telemetry to prioritize vulnerable hosts.
Monitoring Recommendations
- Log all execve calls with arguments on Linux ML hosts and forward to a central data lake for retrospective hunting.
- Monitor egress traffic from training nodes for connections to unrecognized destinations following graph rendering activity.
- Track filesystem changes in home directories and model output paths for artifacts written outside expected locations.
How to Mitigate CVE-2024-0817
Immediate Actions Required
- Inventory hosts and containers running PaddlePaddle 2.6.0 using package managers and image scanning.
- Restrict who can execute arbitrary Python against shared PaddlePaddle installations, particularly in multi-tenant Jupyter or notebook services.
- Audit existing pipelines and notebooks for calls to IrGraph.draw that accept externally sourced arguments and remove or sanitize those inputs.
Patch Information
No fixed version is referenced in the current NVD entry for CVE-2024-0817. Monitor the PaddlePaddle GitHub repository and the Huntr bounty listing for an official fix, and upgrade to a version later than 2.6.0 once vendor guidance confirms remediation.
Workarounds
- Avoid calling IrGraph.draw with any argument derived from untrusted input; validate filenames against an allowlist of alphanumeric characters and safe separators.
- Run PaddlePaddle workloads under least-privilege service accounts inside isolated containers with read-only filesystems and no outbound internet where possible.
- Enforce mandatory access controls (AppArmor, SELinux, or seccomp) to block shell execution by ML worker processes.
# Configuration example: identify vulnerable installations
pip show paddlepaddle | grep -i version
pip list --format=columns | grep -i paddle
# Restrict shell spawning from Python via seccomp/AppArmor profile
# (example AppArmor rule fragment for a PaddlePaddle worker)
deny /bin/sh mrix,
deny /bin/bash mrix,
deny /usr/bin/dash mrix,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
