| --- |
| license: apache-2.0 |
| tags: |
| - security-research |
| - vulnerability-disclosure |
| - poc |
| - do-not-use |
| --- |
| |
| # ⚠️ SECURITY RESEARCH - MALICIOUS MODEL POC |
|
|
| ## 🚨 WARNING: DO NOT USE IN PRODUCTION |
|
|
| This is a **proof-of-concept malicious model** created for responsible security disclosure. |
|
|
| **Purpose:** Demonstrate arbitrary code execution vulnerability in Hugging Face Transformers (GLM4V-MoE / GLM4V weight converters) |
| **Program:** Huntr Bug Bounty (MFV - Model File Vulnerabilities) |
| **Severity:** CRITICAL (CVSS 9.6) |
| **Status:** Responsible disclosure — reported to maintainers |
|
|
| --- |
|
|
| ## Vulnerability Details |
|
|
| ### Summary |
|
|
| This model contains a weaponized `model_optim_rng.pt` pickle file (inside `mp_rank_00/`) |
| that executes arbitrary code when the transformers library's GLM4V-MoE conversion script |
| loads it with `torch.load(..., weights_only=False)` — **without any user warning or |
| TRUST_REMOTE_CODE validation**. |
|
|
| ### Affected Code |
|
|
| **File:** `src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py` |
| **Line:** 275 |
|
|
| ```python |
| file_path = item / "model_optim_rng.pt" |
| assert file_path.exists(), f"model_optim_rng.pt not found in {item}" |
| |
| file_sd = torch.load(file_path, map_location="cpu", weights_only=False) # ❌ UNSAFE! |
| ``` |
|
|
| **Same flaw (non-MoE sister):** `src/transformers/models/glm4v/convert_glm4v_mgt_weights_to_hf.py` line 322. |
|
|
| **Aggravating factor:** both scripts monkeypatch `pickle.Unpickler` (lines 27–39) with an |
| `UnpicklerWrapper` whose `find_class` only blocks modules starting with `megatron`/`glm`/`__main__` — |
| all other modules (e.g. `os`, `builtins`, `subprocess`) resolve normally via `super().find_class()`. |
| This is a compatibility shim ("Avoid Using Megatron Lib"), not a security control. |
|
|
| ### Proof of Exploitation |
|
|
| When this model is converted using the official conversion script: |
|
|
| ```bash |
| python src/transformers/models/glm4v_moe/convert_glm4v_moe_mgt_weights_to_hf.py \ |
| --model_path ./glm4v-moe-rce-poc \ |
| --output_path ./converted |
| ``` |
|
|
| **What happens:** |
| 1. ✅ Conversion script loads `mp_rank_00/model_optim_rng.pt` with `torch.load(..., weights_only=False)` |
| 2. ✅ Pickle exploit triggers via Python's `__reduce__` magic method |
| 3. ✅ Arbitrary code executes (creates `/tmp/pwned_glm4v_moe`) |
| 4. ✅ **NO WARNING** shown to user |
| 5. ✅ **NO TRUST_REMOTE_CODE** check required |
|
|
| **Result:** Full arbitrary code execution with the converter process's privileges. |
|
|
| ### Security Impact |
|
|
| **CVSS Score:** 9.6 (Critical) |
| **Attack Vector:** Network (AV:N) |
| **Attack Complexity:** Low (AC:L) |
| **Privileges Required:** None (PR:N) |
| **User Interaction:** Required (UI:R) |
| **Scope:** Changed (S:C) |
| **Confidentiality:** High (C:H) |
| **Integrity:** High (I:H) |
| **Availability:** High (A:H) |
|
|
| **Impact:** |
| - 🔴 Arbitrary code execution at conversion time |
| - 🔴 Full system compromise |
| - 🔴 Data exfiltration (SSH keys, credentials, API tokens) |
| - 🔴 Persistent backdoor installation |
| - 🔴 Supply chain attack vector |
|
|
| ### ProtectAI Scanner Consideration |
|
|
| This malicious checkpoint is loaded by the **conversion script path**, not the main |
| model-loading path (`from_pretrained`). Model security scanners (e.g. ProtectAI) that |
| inspect `.pkl`/`.safetensors` weight files do not flag `model_optim_rng.pt` inside a |
| megatron checkpoint layout, and the converter has no `TRUST_REMOTE_CODE` gate. |
|
|
| --- |
|
|
| ## Responsible Disclosure |
|
|
| ### Disclosure Timeline |
|
|
| - **Discovery Date:** 2026-08-15 |
| - **Disclosure Platform:** Huntr (https://huntr.com) |
| - **Program:** Model File Vulnerabilities (MFV) |
| - **Status:** Reported to maintainers |
| - **CVE:** Pending assignment |
|
|
| ### Affected Versions |
|
|
| - ✗ Hugging Face Transformers: **>= 4.57.2** (2025-11-24) up to current master (2026-08-15) |
| - ✗ Affected Models: GLM4V / GLM4V-MoE Megatron checkpoints requiring conversion |
|
|
| ### Remediation |
|
|
| **Immediate Fix:** |
|
|
| ```python |
| # BEFORE (UNSAFE) — glm4v_moe:275 / glm4v:322: |
| file_sd = torch.load(file_path, map_location="cpu", weights_only=False) |
| |
| # AFTER (SAFE): |
| file_sd = torch.load(file_path, map_location="cpu", weights_only=True) |
| ``` |
|
|
| If arbitrary objects are genuinely required, gate the load behind an explicit user |
| opt-in (`--trust-remote-code` style), matching the pattern already used in |
| `convert_olmo_hybrid_weights_to_hf.py` / `convert_maskformer_swin_to_pytorch.py`. |
|
|
| --- |
|
|
| **⚠️ This repository contains intentionally malicious content. Download and execute |
| at your own risk, for testing only on isolated systems.** |
|
|
