CVE-2024-12216 Overview
CVE-2024-12216 is an arbitrary file write vulnerability in the dmlc/gluon-cv machine learning library, version 0.10.0. The flaw resides in the ImageClassificationDataset.from_csv() API, which downloads and extracts tar.gz archives from user-supplied URLs without validating archive contents. The extraction routine is susceptible to a TarSlip attack, allowing crafted archives to write files outside the intended directory through path traversal or symbolic link abuse. The vulnerability is categorized under CWE-59: Improper Link Resolution Before File Access.
Critical Impact
Attackers who can influence the dataset URL passed to ImageClassificationDataset.from_csv() can overwrite arbitrary files on the victim's system, leading to code execution or persistent compromise of ML pipelines.
Affected Products
- dmlc/gluon-cv version 0.10.0
- Python-based machine learning workflows invoking ImageClassificationDataset.from_csv()
- Downstream applications and notebooks that ingest untrusted dataset URLs through gluon-cv
Discovery Timeline
- 2025-03-20 - CVE-2024-12216 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12216
Vulnerability Analysis
The ImageClassificationDataset.from_csv() API accepts a URL, downloads the referenced tar.gz archive, and extracts it to a working directory. The extraction step does not verify that member paths remain within the destination directory. It also does not reject symbolic links that point outside the extraction root. A crafted archive can therefore place files at attacker-chosen locations on the local filesystem.
Exploitation requires the victim to invoke the vulnerable API with an attacker-controlled or attacker-influenced dataset URL. User interaction is required, and the impact is limited to the privileges of the process running gluon-cv. Successful writes to locations such as shell startup files, cron directories, Python site-packages, or Jupyter configuration files can escalate the primitive into code execution.
Root Cause
The root cause is unsafe tar extraction. The library calls the underlying archive extractor without filtering member names for traversal sequences (for example, ../) and without resolving symbolic link targets against the extraction root. Python's tarfile module historically extracted all members without safety checks, and gluon-cv 0.10.0 does not apply a validating filter or perform manual path canonicalization before writing files.
Attack Vector
An attacker builds a tar.gz archive containing entries with traversal paths such as ../../../../home/user/.bashrc or symlinks that redirect writes outside the extraction directory. The archive is hosted on a URL that the victim ultimately passes to ImageClassificationDataset.from_csv(). When the function extracts the archive, the malicious members are written to their traversed destinations. The vulnerability details are documented in the Huntr Bug Bounty Report.
Detection Methods for CVE-2024-12216
Indicators of Compromise
- Unexpected files appearing outside the gluon-cv working directory after dataset downloads
- Modifications to shell startup files, cron entries, or Python package directories timed with ML training jobs
- Symbolic links inside downloaded tar.gz archives that resolve to absolute or parent-relative paths
- Archive members containing .. path components extracted by Python processes
Detection Strategies
- Inspect archives before extraction using tar -tvf and flag members whose paths contain .. or absolute prefixes
- Instrument the extraction workflow to log all file paths written by tarfile.extractall() calls
- Compare filesystem state before and after dataset ingestion to identify writes outside expected directories
- Use file integrity monitoring on sensitive directories accessed by ML training user accounts
Monitoring Recommendations
- Alert on file creation or modification events in home directories, /etc, and Python site-packages initiated by Python interpreters running gluon-cv
- Track outbound network requests from ML workloads to identify unexpected dataset URL sources
- Correlate dataset download events with subsequent process executions to detect follow-on payload activation
How to Mitigate CVE-2024-12216
Immediate Actions Required
- Audit all code paths that call ImageClassificationDataset.from_csv() and restrict dataset URLs to trusted sources
- Run gluon-cv workloads under least-privilege service accounts inside isolated containers or sandboxes
- Pre-download and manually validate tar.gz archives before passing their URLs to the vulnerable API
Patch Information
No vendor patch is referenced in the available advisory data. Users of dmlc/gluon-cv 0.10.0 should track the Huntr Bug Bounty Report and the upstream repository for a fixed release. Until a patched version is available, wrap dataset extraction with a validating routine that rejects traversal paths and unsafe symlinks.
Workarounds
- Replace direct calls to ImageClassificationDataset.from_csv() with a wrapper that extracts archives using Python 3.12's tarfile data filter (extractall(filter='data'))
- Manually validate every archive member by resolving its path with os.path.realpath() and confirming it stays within the intended extraction directory
- Execute dataset ingestion inside ephemeral containers with read-only mounts of sensitive host directories
- Block outbound network access from training nodes to only allowlisted dataset repositories
# Configuration example: safe extraction wrapper (Python 3.12+)
python3 -c "import tarfile, sys; \
tarfile.open(sys.argv[1]).extractall(path=sys.argv[2], filter='data')" \
dataset.tar.gz ./safe_extract_dir
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
