CVE-2024-11394: Hugging Face Transformers RCE Vulnerability

CVE-2024-11394 Overview

CVE-2024-11394 is a critical insecure deserialization vulnerability affecting Hugging Face Transformers, a widely-used machine learning library for natural language processing and deep learning applications. This vulnerability allows remote attackers to execute arbitrary code on affected installations through maliciously crafted Trax model files. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious file containing the payload.

The specific flaw exists within the handling of model files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current user, potentially leading to complete system compromise.

Critical Impact

Successful exploitation enables remote code execution in the context of the current user, potentially allowing attackers to steal sensitive data, install malware, pivot to other systems, or establish persistent access to affected environments.

Affected Products

• Hugging Face Transformers (all versions handling Trax model files)

Discovery Timeline

• 2024-11-22 - CVE CVE-2024-11394 published to NVD
• 2025-02-10 - Last updated in NVD database

Technical Details for CVE-2024-11394

Vulnerability Analysis

This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data), a common weakness that occurs when applications deserialize data from untrusted sources without proper validation. In the context of Hugging Face Transformers, the library processes Trax model files that can contain serialized Python objects. When these model files are loaded, the deserialization process can instantiate arbitrary Python objects, potentially executing malicious code embedded within the serialized data.

The attack requires user interaction, meaning a victim must be enticed to download and load a malicious model file. Given the collaborative nature of the machine learning community and the common practice of sharing pre-trained models through platforms like Hugging Face Hub, this attack vector presents a significant risk. Researchers and developers frequently download models from various sources, making them susceptible to supply chain attacks.

Root Cause

The root cause of this vulnerability lies in the insufficient validation of user-supplied data during the deserialization process of Trax model files. Python's native serialization mechanisms, such as pickle, are inherently unsafe when processing untrusted data because they can execute arbitrary code during deserialization. The Transformers library failed to implement adequate safeguards or validation checks when handling model files, allowing malicious payloads to be executed upon loading.

Attack Vector

The attack vector for CVE-2024-11394 operates through the network, requiring the victim to interact with a malicious resource. The exploitation scenario typically unfolds as follows:

1. An attacker crafts a malicious Trax model file containing a serialized Python object designed to execute arbitrary code upon deserialization
2. The attacker hosts this malicious model on a public repository, phishing page, or distributes it through other social engineering means
3. A victim downloads or loads the malicious model file using Hugging Face Transformers
4. During the model loading process, the serialized payload is deserialized without proper validation
5. The malicious code executes in the context of the current user, granting the attacker access to the system

This vulnerability was tracked by the Zero Day Initiative as ZDI-CAN-25012. For additional technical details, refer to the Zero Day Initiative Advisory ZDI-24-1515.

Detection Methods for CVE-2024-11394

Indicators of Compromise

• Unexpected network connections originating from Python processes handling machine learning workloads
• Suspicious process spawning or command execution following model file loading operations
• Unusual file system modifications or new files created in user directories after loading external models
• Anomalous behavior from transformers library processes, including attempts to access sensitive system resources

Detection Strategies

• Monitor for suspicious deserialization patterns in Python applications, particularly those involving pickle or similar serialization libraries
• Implement file integrity monitoring on model storage directories to detect unauthorized modifications
• Deploy endpoint detection solutions capable of identifying code execution patterns associated with deserialization attacks
• Analyze network traffic for model downloads from untrusted or unknown sources

Monitoring Recommendations

• Enable verbose logging for Hugging Face Transformers operations to capture model loading events
• Implement behavioral monitoring for Python processes to detect post-exploitation activities
• Monitor for unusual child process creation from machine learning application processes
• Track model file downloads and maintain an inventory of trusted model sources

How to Mitigate CVE-2024-11394

Immediate Actions Required

• Audit all model files currently in use and verify they originate from trusted sources
• Restrict model downloads to verified repositories and implement allowlisting for approved model sources
• Isolate machine learning workloads in sandboxed environments with restricted permissions
• Update Hugging Face Transformers to the latest version that addresses this vulnerability
• Educate development teams about the risks of loading untrusted model files

Patch Information

Organizations should update Hugging Face Transformers to the latest available version. Consult the Zero Day Initiative Advisory ZDI-24-1515 for specific version information and vendor guidance. Given the high EPSS percentile of 96.58%, indicating a significant probability of exploitation in the wild, patching should be prioritized.

Workarounds

• Only load model files from trusted and verified sources, such as official Hugging Face repositories with verified checksums
• Implement network segmentation to isolate machine learning environments from critical infrastructure
• Run model loading operations in containerized or sandboxed environments with minimal privileges
• Consider implementing custom model loading functions that validate file contents before deserialization
• Disable automatic model downloads and require manual verification before loading new models

# Configuration example
# Run transformers in isolated environment with restricted permissions
docker run --rm -it \
  --network none \
  --read-only \
  --security-opt=no-new-privileges \
  -v /path/to/trusted/models:/models:ro \
  python:3.10-slim python -c "from transformers import AutoModel; model = AutoModel.from_pretrained('/models/verified-model')"