Path Traversal in DeepGraphLearning KnowledgeGraphEmbedding

Executive Summary

This vulnerability is a path traversal flaw in DeepGraphLearning KnowledgeGraphEmbedding. It occurs in the override_config function of codes/run.py when the data_path argument is manipulated. The issue allows attackers to craft malicious config.json files with paths pointing outside the intended directory, enabling them to read arbitrary files from the filesystem. The attack is triggered remotely and can expose sensitive file contents.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious config.json files in KnowledgeGraphEmbedding checkpoints that contain absolute or relative paths outside the checkpoint directory. Review error logs for file path echoes or failed integer conversions during model evaluation. Use the PoC from Resource 1 to test if your system is vulnerable by running make_poc.py and checking for unintended file access.

• Inspect config.json files in checkpoints for unvalidated data_path entries pointing to sensitive system files.
• Monitor logs for error messages containing file contents or paths during model evaluation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read sensitive files on your system by exploiting path traversal. If you use third-party checkpoints without specifying a data_path, the system may load malicious configurations that expose file contents. This could lead to data leaks or incorrect evaluation results if attackers control the data used.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing sensitive data through path traversal. Unauthorized access to files containing personal or health information violates confidentiality requirements. Organizations using this software may face legal penalties or data breach notifications.

Useful 0 Not Useful 0

Mitigation Strategies

Always specify --data_path explicitly when evaluating third-party checkpoints to prevent override_config from using untrusted paths. Remove or restrict the data_path override in codes/run.py to ensure paths stay within the checkpoint directory. Avoid using untrusted checkpoints until the project releases a fix.

• Add input validation in override_config to restrict data_path to the checkpoint directory.
• Update to the latest version once the maintainers release a patch addressing this issue.

Useful 0 Not Useful 0