pragnyanramtha/onnxruntime-bytes-external-data-lfr-poc

ONNX Runtime Byte-Loaded External Data CWD File Read PoC

This is a benign security PoC for ONNX Runtime external-data handling. It does not execute code, make network connections, persist changes, or access credentials. The local file read is demonstrated with a temporary marker file created by the verifier.

Summary

bytes_lfr/cwd_external_data_reader.onnx contains an initializer with:

data_location = EXTERNAL
external_data.location = service_secret.txt
external_data.length = 28

When the same model is loaded from a filesystem path, ONNX Runtime resolves service_secret.txt relative to the model file directory. When the model is loaded from raw bytes with onnxruntime.InferenceSession(model_bytes), ONNX Runtime resolves service_secret.txt relative to the process current working directory. The PoC creates a benign service_secret.txt in a temporary CWD and shows that the model outputs its contents.

Why This Is Stronger

This is not a toy output override. The model artifact causes ONNX Runtime to read ambient local filesystem data during normal session creation from bytes. Many model-serving APIs accept uploads as bytes or read a model blob into memory before passing it to ONNX Runtime.

Files

• bytes_lfr/cwd_external_data_reader.onnx - ONNX model that references service_secret.txt as external tensor data.
• bytes_lfr/manifest.json - artifact hash, size, expected marker, and external-data location.
• make_bytes_lfr_poc.py - generator for the ONNX artifact.
• verify_bytes_lfr_poc.py - creates a temporary CWD marker file and validates path-load vs byte-load behavior.
• bytes_lfr_results.json - captured local validation output.
• research/probe_save_external_data_paths.py - save-side path traversal probe used during research.
• research/save_path_probe_results.json - save-side path probe results for ONNX 1.21.0.

Reproduction

python -m venv .venv
.\.venv\Scripts\python -m pip install -r .\requirements.txt
.\.venv\Scripts\python .\verify_bytes_lfr_poc.py

Expected key result:

ort_bytes_load_from_service_cwd.status       loaded
ort_bytes_load_from_service_cwd.output_ascii BENIGN_SERVICE_SECRET_MARKER
ort_bytes_load_without_secret.status         blocked

The verifier also confirms that path-loaded ONNX Runtime sessions read the companion file from the model directory instead of the process CWD.

Tested Versions

• Python 3.12.12
• ONNX 1.21.0
• ONNX Runtime 1.26.0
• ModelScan 0.8.8

Artifact Hash

cwd_external_data_reader.onnx  27ba84c9f7343c4c6efea4cbb7c5ac32900d4ba622ed3f25a5ea79d42cfa7293

Scanner Behavior

ModelScan 0.8.8 reports total_issues: 0 and scanned.total_scanned: 0 for the .onnx model in this environment.

Impact

If a service accepts an untrusted ONNX model as bytes and calls onnxruntime.InferenceSession(model_bytes), the model can reference and read a file from the service process CWD as external tensor data. The file bytes are then available as normal model output. In real deployments, common CWD files can include .env, config files, local tokens, temporary request data, or adjacent application state.

Limitations

• This is local file read, not arbitrary code execution.
• The PoC reads from the process CWD, not arbitrary absolute paths or parent directories.
• The attacker must know or guess the target filename and expected byte length, or submit multiple variants.
• The behavior is specific to byte-loaded models. Path-loaded models resolve external data relative to the model path.

Mitigations

• Reject external-data tensors when loading untrusted ONNX models from bytes.
• Require callers using byte-loaded models to provide an explicit external-data base directory, or fail closed when no model path exists.
• Load untrusted models from an isolated temporary directory with no secrets in CWD.
• Add scanner coverage for ONNX external-data references.