| --- |
| license: unknown |
| tags: |
| - security |
| - poc |
| - huntr |
| --- |
| |
| # Caffe `.prototxt` Python layer → RCE PoC |
|
|
| `malicious_deploy.prototxt` declares a layer with `type: "Python"` and |
| `python_param { module: "evil_layer" layer: "Pwn" }`. |
|
|
| `GetPythonLayer()` (`src/caffe/layer_factory.cpp:290-301`) — called from |
| `LayerRegistry::CreateLayer()` whenever `caffe.Net(prototxt, weights, phase)` |
| loads a `.prototxt` — takes those two strings straight from the attacker's |
| `.prototxt` with zero validation: |
|
|
| ```cpp |
| bp::object module = bp::import(param.python_param().module().c_str()); |
| bp::object layer = module.attr(param.python_param().layer().c_str())(param); |
| ``` |
|
|
| `bp::import(module)` imports an arbitrary Python module by name (running its |
| top-level code immediately), then instantiates an arbitrary class from it by |
| name. `evil_layer.py` (also in this repo) is the companion module that must |
| be importable (on `PYTHONPATH`/cwd) when the victim loads this `.prototxt` — |
| exactly the normal distribution pattern for Caffe models that ship custom |
| Python layers (e.g. py-faster-rcnn's `rpn/proposal_layer.py`). |
|
|
| `BUILD_python_layer` is CMake's **default-ON** build option |
| (`CMakeLists.txt:38`). |
|
|
| Loading this `.prototxt` with `caffe.Net()` executes `evil_layer.py`'s |
| module-level code and the `Pwn` class constructor. |
|
|
| Verified against the real compiled `libcaffe.so` inside Docker (`bvlc/caffe:cpu`, `WITH_PYTHON_LAYER` confirmed) — real `caffe.Net()` call, not a source reimplementation. |
|
|
| Reported to huntr.com as a Model File Vulnerability (MFV) submission |
| ("Caffe" format). |
|
|
