PT-2023-12827 · Onnx · Onnx

Jnovikov · Published 2023-01-25 · Updated 2025-01-22 · CVE-2022-25882

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions onnx versions prior to 1.13.0

Description The issue allows Directory Traversal, where the external data field of the tensor proto can contain a path to a file outside the model's current directory or user-provided directory. For example, an attacker could use a path like "../../../etc/passwd".

Recommendations For versions prior to 1.13.0, update to version 1.13.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-25854

CVE-2022-25882

GHSA-FFXJ-547X-5J7C

PYSEC-2023-38

Affected Products

Onnx

References · 21

• 🔥 https://github.com/onnx/onnx/issues/3991 · Exploit
• 🔥 https://gist.github.com/jnovikov/02a9aff9bf2188033e77bd91ff062856 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-PYTHON-ONNX-2395479 · Exploit
• https://github.com/onnx/onnx/pull/4400 · Patch
• https://github.com/onnx/onnx/commit/f369b0e859024095d721f1d1612da5a8fa38988d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-25882 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-25882 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffxj-547x-5j7c · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-38 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25882 · Security Note
• https://ubuntu.com/security/CVE-2022-25882 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-25882 · Security Note
• https://osv.dev/vulnerability/AZL-25854 · Vendor Advisory
• https://github.com/onnx/onnx · Note
• https://github.com/onnx/onnx/blob/96516aecd4c110b0ac57eba08ac236ebf7205728/onnx/checker.cc%23L129 · Note