You can deploy this model and start earning money today!

htdy7703/
onnx-save-model-file-like-external-write-poc

Name: onnx-save-model-file-like-external-write-poc
Availability: InStock

Views

No views yet

ONNX save_model file-like external-data cwd file-append PoC

This PoC demonstrates a verified ONNX issue in the shipped onnx 1.22.0 wheel:

public API: onnx.save_model()
trigger: saving attacker-controlled tensor data to a non-path writable file-like object
effect: ONNX writes external tensor sidecar data into the process working directory
stronger proven path: with all_tensors_to_one_file=False, attacker-controlled tensor names become sidecar filenames and attacker-controlled tensor bytes are appended to the matching local file

Repo contents

repro.py: end-to-end reproducer that builds the malicious ONNX model in memory, saves it to a file-like wrapper, and proves local .env corruption in the current working directory
README.md: impact summary and usage notes

What this proves

The PoC creates a benign local .env file, builds an ONNX model whose initializer is also named .env, and then calls:

python

onnx.save_model(
    model,
    FileStorage(stream=io.BytesIO(), filename="output.onnx", name="file"),
    save_as_external_data=True,
    all_tensors_to_one_file=False,
    size_threshold=0,
)

Because ONNX trusts the wrapper .name metadata as if it were a real model path, the external-data write is anchored to the current working directory instead of an explicit trusted export directory. The local .env file ends up containing the appended attacker payload.

Run

python repro.py

Expected signal:

wrapper name: file
cwd files: ['.env']
appended payload: True

htdy7703/onnx-save-model-file-like-external-write-poc

ONNX save_model file-like external-data cwd file-append PoC

Repo contents

What this proves

Run

htdy7703/
onnx-save-model-file-like-external-write-poc