CVE-2024-7776: Onnx Path Traversal Vulnerability

CVE-2024-7776 Overview

A path traversal vulnerability exists in the download_model function of the ONNX (Open Neural Network Exchange) framework, affecting versions up to and including 1.16.1. The vulnerability stems from inadequate prevention of path traversal attacks when processing malicious tar files, allowing attackers to overwrite arbitrary files in the user's directory. This can potentially lead to remote command execution through strategic file overwrites.

Critical Impact

Attackers can exploit this vulnerability to overwrite arbitrary files on the target system, potentially leading to remote command execution by modifying configuration files, scripts, or other critical system components.

Affected Products

• ONNX Framework versions ≤ 1.16.1
• Applications utilizing the download_model function from the onnx/onnx package
• Machine learning pipelines that automatically download ONNX models from external sources

Discovery Timeline

• 2025-03-20 - CVE-2024-7776 published to NVD
• 2025-03-26 - Last updated in NVD database

Technical Details for CVE-2024-7776

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as a path traversal or directory traversal vulnerability. The download_model function in the ONNX framework fails to properly sanitize file paths contained within tar archives before extraction.

When a user downloads a model from an untrusted or compromised source, a maliciously crafted tar file can contain entries with path traversal sequences (such as ../) in their filenames. Without proper validation, these sequences allow the extraction process to write files outside the intended directory, potentially overwriting critical system files or user data.

The network attack vector combined with no authentication requirements makes this vulnerability particularly dangerous in automated ML pipelines that download models programmatically. An attacker could host a malicious model on a seemingly legitimate source or perform a man-in-the-middle attack to inject a malicious tar archive during the download process.

Root Cause

The root cause lies in the insufficient validation of file paths within tar archives before extraction in the download_model function. The function does not properly check for or sanitize path traversal sequences (../, ..\\, or absolute paths) embedded in the filenames of archived entries. This allows attackers to craft tar files that, when extracted, write content to arbitrary locations on the filesystem rather than the intended model directory.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can exploit this vulnerability through several methods:

1. Malicious Model Hosting: An attacker hosts a crafted ONNX model package containing a malicious tar archive on a public repository or server
2. Supply Chain Attack: Compromising an existing model repository to replace legitimate models with malicious versions
3. Man-in-the-Middle: Intercepting network traffic to inject malicious tar content during model downloads

The vulnerability can lead to arbitrary file overwrite, which attackers can leverage to overwrite shell configuration files (.bashrc, .profile), cron jobs, SSH authorized keys, or other executable scripts to achieve remote command execution.

The malicious tar archive would contain entries with path traversal sequences in filenames, such as ../../../.bashrc or ../../../.ssh/authorized_keys, allowing the attacker to write arbitrary content to these sensitive locations during the extraction process.

Detection Methods for CVE-2024-7776

Indicators of Compromise

• Unexpected file modifications in user home directories, particularly shell configuration files (.bashrc, .profile, .zshrc)
• New or modified files in .ssh/authorized_keys that were not added by legitimate users
• Unusual cron job entries or scheduled tasks appearing after model downloads
• Modified Python scripts or configuration files in unexpected locations
• Log entries showing model downloads followed by suspicious file system activity

Detection Strategies

• Monitor file system activity during ONNX model download operations for writes outside expected directories
• Implement file integrity monitoring (FIM) on critical system and user configuration files
• Audit network traffic for ONNX model downloads from untrusted or suspicious sources
• Review application logs for calls to the download_model function with external URLs
• Deploy endpoint detection rules to identify path traversal patterns in tar extraction operations

Monitoring Recommendations

• Enable verbose logging for ML pipeline operations that download external models
• Configure alerts for file modifications to shell configuration files and SSH keys
• Monitor for process execution from recently modified scripts or configuration files
• Track network connections to unknown model hosting services
• Implement baseline monitoring for the ONNX model cache directory to detect anomalous extractions

How to Mitigate CVE-2024-7776

Immediate Actions Required

• Upgrade the ONNX framework to a patched version when available (versions after 1.16.1)
• Audit existing code for usage of the download_model function with untrusted sources
• Restrict model downloads to verified and trusted repositories only
• Implement network segmentation to limit exposure of systems running vulnerable ONNX versions
• Consider temporarily disabling automated model download functionality until patched

Patch Information

Organizations should monitor the official ONNX GitHub repository and security advisories for patch releases addressing this vulnerability. The vulnerability was reported through the Huntr Bounty Report. Until an official patch is available, implementing the workarounds below is strongly recommended.

Workarounds

• Download models manually and verify their integrity before extraction using hash verification
• Implement a custom wrapper around the download_model function that validates tar entry paths before extraction
• Use container isolation or sandboxing when downloading and extracting models from external sources
• Configure application permissions to run with minimal filesystem write access
• Set up a curated internal model repository with pre-verified models to avoid downloading from external sources

# Example: Verify model integrity before use
# Download model to isolated directory
mkdir -p /tmp/onnx_staging
cd /tmp/onnx_staging

# Verify tar contents for path traversal before extraction
tar -tvf downloaded_model.tar.gz | grep -E '(^\.\./|/\.\./|^\/)' && echo "WARNING: Potentially malicious paths detected"

# Only extract if verification passes
# Consider using a dedicated unprivileged user for model extraction