mholmquist/mmengine-d61-poc

MMEngine D61 checkpoint-config execution PoC

Private/gated proof of concept for arbitrary code execution in OpenMMLab MMEngine >=0.5.0, <=0.10.7 (CWE-94).

This is not a pickle gadget. The malicious .pth checkpoint contains only primitive dict/string values and an empty state_dict, so it passes PyTorch safe loading:

torch.load("evil.pth", map_location="cpu", weights_only=True)   # succeeds

Code execution happens afterward, on the documented inference path. When a BaseInferencer is built with model=None, BaseInferencer._init_model (mmengine/infer/infer.py) recovers the config from checkpoint["message_hub"]["runtime_info"]["cfg"] (or checkpoint["meta"]["cfg"]) and parses it as Python via Config.fromstring(..., file_format=".py"), executing attacker code before any model weights are used.

Files

• evil.pth - proof-of-concept checkpoint (pure data; passes weights_only=True).
• generate_malicious.py - regenerates evil.pth.
• load_driver.py - builds BaseInferencer(model=None, weights=evil.pth), exercising the documented inference API; the config recovered from the checkpoint is executed via Config.fromstring.
• requirements.txt - tested dependencies.

Reproduction

python -m pip install -r requirements.txt
python generate_malicious.py --out evil.pth --canary /tmp/d61-mmengine-canary
python load_driver.py --checkpoint evil.pth --canary /tmp/d61-mmengine-canary

Expected output:

Loads checkpoint by local backend from path: evil.pth
inferencer init raised after payload fired (expected): KeyError
canary_exists=True
canary_contents=d61

The KeyError is the expected failure of MODELS.build(cfg.model) on the dummy model type, which occurs after Config.fromstring has already executed the attacker config (the canary is written first).

Negative control: set the checkpoint config to model = dict(type='DummyModel') with no code statement. The checkpoint still loads and the config still parses, but the canary is not created (canary_exists=False).

Affected versions

• mmengine >=0.5.0, <=0.10.7 (mmengine/infer/infer.py / BaseInferencer first shipped in 0.5.0).
• Patched version: none known at submission time.
• CWE-94 (Improper Control of Generation of Code).