GHSA-rghg-q7wp-9767: OS Command Injection
Comment from JPCERT/CC We are submitting the report again as we have yet to receive any responses from you after submitting it on February 5 and March 11.
It would be greatly appreciated if you could send us a message after confirming it so that we can follow up the case by email.
Summary MONAI vulnerable to OS command injection.
Details This library concatenates user-controlled values (YAML's "datasetnameorid" or part of "CLI/kwargs") without quoting or validation. Since this string is passed to subprocess with shell=True, shell metacharacters (e.g., Windows: & / Linux: ;) are interpreted.
As a result, arbitrary commands can be concatenated and executed. Therefore, the reporter identifies this as CWE-78 (OS Command Injection).
The victim needs to load a crafted YAML file in the code that launches training/validation jobs based on the configuration (YAML/arguments). There are no other constraints.
PoC Verified on Windows. Load a modified YAML file with crafted "datasetnameorid" as follows. Add command separator characters (such as & or ;) and insert arbitrary commands.
datasetnameorid: '4 & echo "This is exploited" > "C:\Users\shima\OneDrive\Desktop\tmp\test.txt" & rem' dataroot: C:/Users/shima/OneDrive/Desktop/tmp/data datalist: C:/Users/shima/OneDrive/Desktop/tmp/lists/task4.json workdir: C:/Users/shima/OneDrive/Desktop/tmp/work nnunetraw: C:/Users/shima/OneDrive/Desktop/tmp/nnUNetraw nnunetpreprocessed: C:/Users/shima/OneDrive/Desktop/tmp/nnUNetpreprocessed nnunetresults: C:/Users/shima/OneDrive/Desktop/tmp/nnUNetresults
As a victim, verify running the following Python code to load and process the YAML file.
from monai.apps.nnunet.nnunetv2runner import nnUNetV2Runner from pathlib import Path #Path of the crafted YAML file YAML = r"C:\Users\shima\OneDrive\Desktop\tmp\test.yaml" #Text file overwritten when command executes OUT = Path(r"C:\Users\shima\OneDrive\Desktop\tmp\test.txt") #Read YAML runner = nnUNetV2Runner(inputconfig=YAML, trainerclassname="nnUNetTrainer") runner.trainsinglemodel(config="3dfullres", fold=0, gpuid=0) #Verify command execution print("Result:", OUT.readtext(encoding="utf-8").strip())
Also, see the attached file. JVN#50379904-details.zip
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/MONAIto a version that resolves this vulnerability.Fixed in 1.6.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Systems are exposed when they load an attacker-crafted YAML configuration or attacker-controlled CLI/keyword argument values in code that launches training or validation jobs. The vulnerable input includes YAML's dataset_name_or_id field and part of CLI/kwargs values.
What does an attacker need to exploit this issue?
An attacker needs the victim to load a crafted YAML file, or otherwise supply crafted values through the relevant CLI/kwargs path. They can use shell metacharacters such as & on Windows or ; on Linux to append arbitrary commands.
What can be done if patching is not immediately possible?
Avoid loading untrusted YAML configurations or accepting untrusted values for dataset_name_or_id and the affected CLI/kwargs inputs in training or validation job workflows. Restrict who can modify job configurations and arguments until a remediation can be applied.
How can I check for possible exploitation or unsafe configurations?
Review YAML files and job arguments for shell metacharacters or unexpected command content in dataset_name_or_id and related CLI/kwargs values. The provided proof of concept uses a command separator followed by an arbitrary command, such as & on Windows.