CVE-2024-27318

Directory Traversal vulnerability in onnx versions ≤ 1.15.0 allows file access.

• CVSS 7.5
• CWE-22
• Input Validation and Sanitization
• Local

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

CVE

CVE-2024-27318

CWE

CWE-22

CVSS base score

7.5

Published

2024-02-23

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Information Disclosure

Affected component

onnx

Fixed by upgrading

Yes

Solution

Upgrade to onnx version 1.15.1 or later.

import os

def read_file(filename):
    """Read file - VULNERABLE to path traversal"""
    try:
        # VULNERABILITY: No path validation
        # Attacker can use ../../../etc/passwd
        with open(filename, 'r') as f:
            return f.read()
    except Exception as e:
        return f"Error: {e}"

# Example exploitation:
# read_file("../../../etc/passwd")

import os
from pathlib import Path

def read_file_secure(filename):
    """Securely read file with path validation"""
    try:
        # Input validation
        if not filename or '..' in filename:
            return "Error: Invalid filename"
        
        # Restrict to safe directory
        safe_dir = Path("/safe_files")
        file_path = (safe_dir / filename).resolve()
        
        # Ensure path is within safe directory
        if not str(file_path).startswith(str(safe_dir)):
            return "Error: Path traversal detected"
        
        with open(file_path, 'r') as f:
            return f.read()
    except Exception:
        return "Error: Access denied"

external_data: "../sensitive_data.txt"

@misc{vaitp:cve202427318,
  title        = {{Directory Traversal vulnerability in onnx versions ≤ 1.15.0 allows file access.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-27318},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-27318/}}
}