Broly: 1 finding(s), none at or above high
Note
Summary
1 actionable finding(s) in this PR
- 🟡 1 medium
All actionable items are in the annotations.
No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.
Scanned in 2m20.55s.
Annotations
Check warning on line 513 in src/xorl/server/weight_sync/handler.py
broly-code-security-scanner / Broly Security Scan
[MEDIUM] Path traversal via unsanitized `model_id` in adapter export directory construction. The `model_id` field from the command payload is used directly in `os.path.join` to construct a file path without sanitization, while the adjacent `weight_version` field IS properly sanitized via `_safe_abort_token`. An attacker who can send a sync command with a malicious `model_id` (e.g., `/tmp/evil` or `../../../etc/cron.d/evil`) can cause `trainer.save_lora_only` to write adapter files (adapter_model.safetensors, adapter_config.json) to arbitrary filesystem locations.
Path traversal via unsanitized `model_id` in adapter export directory construction. The `model_id` field from the command payload is used directly in `os.path.join` to construct a file path without sanitization, while the adjacent `weight_version` field IS properly sanitized via `_safe_abort_token`. An attacker who can send a sync command with a malicious `model_id` (e.g., `/tmp/evil` or `../../../etc/cron.d/evil`) can cause `trainer.save_lora_only` to write adapter files (adapter_model.safetensors, adapter_config.json) to arbitrary filesystem locations.: An attacker with access to the training server's RPC interface can write arbitrary files to the filesystem by setting `model_id` to a path traversal string. Because `os.path.join` discards all prior components when a subsequent component is an absolute path, a `model_id` value like `/tmp/evil` causes `export_dir` to become `/tmp/evil/latest`, completely bypassing the intended `base_dir/weight_sync_adapters/` containment. This enables arbitrary file write, which could lead to code execution (e.g., writing to cron directories, SSH authorized_keys, or overwriting application files). The attack requires the ability to invoke `handle_sync_inference_weights` with a crafted `model_id` in the command payload.