You can deploy this model and start earning money today!

pragnyanramtha/
onnx-hash-symlink-helper-poc

Name: onnx-hash-symlink-helper-poc
Availability: InStock

Views

No views yet

ONNX External Data Helper `#` Symlink PoC

Benign security proof-of-concept for a conditional ONNX external-data helper path issue.

Summary

ONNX 1.21.0 rejects this model with default onnx.load(...), and ONNX Runtime 1.26.0 rejects it during InferenceSession(...). However, two public ONNX helper paths read the external data through a #-prefixed parent symlink when callers pass an empty base directory:

onnx.external_data_helper.load_external_data_for_model(model, base_dir="")
onnx.numpy_helper.to_array(tensor, base_dir="")

The common precondition is code that derives the base directory from a relative filename in the current working directory:

python

model_path = "poc_hash_external.onnx"
base_dir = os.path.dirname(model_path)  # ""

The model-controlled external data location is:

#outside/marker.bin

The package supplies model_dir/#outside as a symlink to ../outside_dir. The helper path reads ONNX_HASH_SYMLINK_READ through that parent symlink.

Severity

Medium, CVSS 5.0.

Rationale: local file read through model-controlled ONNX external data, but only for explicit helper usage with base_dir="". Default onnx.load(...) and ONNX Runtime reject the same artifact in local validation.

Tested Versions

onnx==1.21.0
onnxruntime==1.26.0
modelscan==0.8.8
Python 3.12.3
Linux filesystem with symlink support

Files

onnx_hash_symlink_case.tar: PoC package preserving the symlink relationship.
verify_poc.py: Extracts the tar, verifies the helper/runtime behavior, and prints JSON evidence.
make_poc.py: Rebuilds the PoC package files from scratch.
verify_original.py: Original local verifier used during research.
requirements.txt: Tested dependency versions.

The tar archive contains:

text

model_dir/poc_hash_external.onnx
model_dir/#outside -> ../outside_dir
outside_dir/marker.bin

Reproduce

bash

python -m venv .venv
. .venv/bin/activate
pip install -r requirements.txt

python verify_poc.py

Expected result:

symlink_exists: true
symlink_target: ../outside_dir
external_helper_relative_dirname.stdout contains ONNX_HASH_SYMLINK_READ
numpy_helper_to_array_relative_dirname.stdout contains ONNX_HASH_SYMLINK_READ
onnx_load_default.returncode is non-zero
onnxruntime_file.returncode is non-zero
impact: onnx_external_helpers_read_marker_through_hash_parent_symlink

Artifact Hashes

text

f1402b58cb192a32d68bf3e20ed8a957d48865456921d460c2e3f3bbb8bccd27  onnx_hash_symlink_case.tar
d1049d3f676d53cfa93589b4a9b5c8f4b482a9a447d5f4afded50517ad176cf4  model_dir/poc_hash_external.onnx
6519070ba079418a50ef1e664e2407cd6d2cca143e864dc1b6ba1ed62cb30640  outside_dir/marker.bin

Impact

Applications that load an ONNX model without external data and then call public helper APIs with base_dir=os.path.dirname(model_path) can accidentally pass base_dir="" for relative filenames in the current working directory. In ONNX 1.21.0, the # external-data special case lets a parent symlink named #outside bypass the intended model-directory isolation in that helper path.

The PoC is benign and reads only a controlled marker file.

Limitations

Not remote code execution.
Not default onnx.load(...) impact.
Not ONNX Runtime impact.
Requires a symlink-capable package/workspace and helper usage with base_dir="".
Adjacent to prior ONNX external-data symlink/hardlink advisories, but this PoC reproduces on ONNX 1.21.0 through the # special case and a narrower helper API precondition.

Suggested Mitigation

Treat base_dir="" as the model's actual containing directory rather than as a relative working-directory path, or reject empty base directories for external data. The # internal-memory-location special case should not skip containment and symlink validation for helper APIs that open external data from disk.

pragnyanramtha/onnx-hash-symlink-helper-poc

ONNX External Data Helper # Symlink PoC