Code Injection in yolov9 ONNX Metadata Handler

Executive Summary

This vulnerability is a code injection flaw in the WongKinYiu yolov9 0.1 software. It exists in the DetectMultiBackend.__init__ function of models/common.py, specifically in the ONNX Metadata Handler component. The issue occurs because the 'names' entry in the ONNX model's metadata is passed directly to Python's eval() function without proper sanitization. Attackers can exploit this by crafting a malicious .onnx file with embedded code in the metadata. When a victim loads this file, the embedded code executes with the victim's privileges, leading to arbitrary code execution.

The vulnerability is classified under CWE-95 (Eval Injection) and CWE-94 (Code Injection). It affects all revisions of yolov9 that include the ONNX Runtime branch of DetectMultiBackend. The exploit is possible because ONNX Runtime parses metadata as plain text and returns it as a dictionary, which is then evaluated as a Python expression.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect ONNX model files for malicious metadata. Check for unexpected or obfuscated entries in the metadata_props map, particularly the 'names' field. Review logs for unusual file creation or execution during model loading. Use commands like 'strings evil.onnx | grep -i names' or 'python -c "import onnx; print(onnx.load('model.onnx').metadata_props)"' to inspect metadata.

Useful 0 Not Useful 0

Impact Analysis

If you use yolov9 with ONNX models, an attacker could trick you into loading a malicious .onnx file. This could allow the attacker to execute arbitrary code on your system with your privileges. Potential impacts include unauthorized access to your system, data theft, installation of malware, or disruption of services. The attack is stealthy because the malicious .onnx file appears valid until loaded.

The vulnerability is particularly dangerous if you download models from untrusted sources like model zoos or shared repositories. Even trusted sources could be compromised. The exploit requires no special access beyond loading the malicious file, making it a significant risk for all users of yolov9 with ONNX support.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA due to unauthorized data access or processing. GDPR requires protection of personal data, and a breach could result in fines up to 4% of global revenue. HIPAA mandates safeguards for protected health information; a breach could lead to penalties and loss of trust. Organizations using yolov9 must ensure compliance by mitigating this risk through updates or alternative implementations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately stop using ONNX model files from untrusted sources. Update the DetectMultiBackend.__init__ function to replace eval(meta['names']) with ast.literal_eval for safe evaluation. Audit all ONNX model metadata for suspicious entries. Consider disabling ONNX model loading until patches are applied.

Useful 0 Not Useful 0