Skip to main content

Zip Slip & Tar Bombs: RCE and DoS Attacks on AI Pipelines

In Machine Learning Operations (MLOps), datasets, pre-trained model weights, and checkpoints are routinely transported as compressed archives (.zip, .tar.gz, .whl). Because AI infrastructure is designed to ingest and decompress massive files automatically, it presents a highly lucrative target for two devastating attack vectors: Denial of Service (Decompression Bombs) and Arbitrary File Overwrites (Zip Slip).

1. Zip Bombs & Tar Bombs (Denial of Service)​

A Decompression Bomb is a maliciously crafted archive file. While its compressed size is minuscule (often just a few kilobytes), its uncompressed size is exponentially larger—sometimes reaching petabytes of garbage data (e.g., the infamous 42.zip).

The Impact on MLOps Infrastructure​

When an automated CI/CD runner, a data ingestion script, or a naive security scanner attempts to extract a Zip Bomb, the consequences are catastrophic:

  1. Disk Exhaustion: The extraction process rapidly consumes all available storage on the host machine or Kubernetes node, causing unrelated services to crash.
  2. CPU and RAM Spikes: The decompression algorithm consumes 100% of CPU cycles and rapidly exhausts system RAM.
  3. OOM Kills: The Linux kernel's Out-Of-Memory (OOM) Killer intervenes, forcefully terminating the process (Exit Code 137). In a Kubernetes environment, this can lead to pod eviction and cascading node failures.

2. Zip Slip (Path Traversal to RCE)​

While a Tar Bomb seeks to crash the system, Zip Slip seeks to hijack it. Zip Slip is an arbitrary file overwrite vulnerability that leverages archives containing files with directory traversal sequences (e.g., ../../) in their filenames.

When a naive Python script uses the standard zipfile or tarfile library to extract the archive without sanitizing the output path, the attacker can overwrite sensitive system files outside the designated extraction directory.

The Exploit Chain​

An attacker uploads a poisoned model archive to an internal registry or a public hub. The archive contains a file named: ../../../../etc/cron.d/malware

When the MLOps pipeline extracts the model:

# ❌ VULNERABLE: Naive extraction
import tarfile

def load_model(tar_path):
    with tarfile.open(tar_path, 'r:gz') as tar:
        # Extracts to the current directory, but path traversal overrides it
        tar.extractall(path="./model_weights")

The extraction process resolves the relative path, escapes the ./model_weights directory, and writes the payload directly into /etc/cron.d/malware. The system's cron daemon then executes the attacker's payload with root privileges, achieving full Remote Code Execution (RCE).

Infrastructure-Level Defense with Veritensor​

Protecting against malicious archives requires a multi-tiered approach: software-level heuristics, safe extraction APIs, and strict infrastructure-level sandboxing. Veritensor implements all three.

Tier 1: The SafeZipReader (Software Heuristics)​

Before Veritensor attempts to extract an archive for deep YARA scanning, the SafeZipReader inspects the archive's internal headers (infolist).

  • Compression Ratio Limits: It calculates the ratio between the compress_size and file_size. If the ratio exceeds 20x (or 100x depending on configuration), the scanner immediately throws a ZipBombError.
  • Absolute Size Limits: It calculates the total uncompressed size of all files. If the total exceeds 2 Gigabytes, the scan is aborted.
  • Nested Archive Detection: The engine flags nested archives (.zip inside a .zip) as MEDIUM threats, as nesting is a primary vector for exponential expansion.

Tier 2: Path Sanitization (Zip Slip Prevention)​

During the actual extraction process, Veritensor abandons unsafe functions like tar.extractall(). Instead, it intercepts every file operation, resolving absolute paths and deterministically blocking any member attempting a Path Traversal escape. It utilizes tar.extractfile() to safely read the byte stream without blindly writing to the filesystem, neutralizing symlink-based Zip Slip attacks.

Tier 3: tmpfs Sandboxing (Infrastructure Enforcement)​

Software heuristics are insufficient because archive headers can be maliciously spoofed by an attacker.

To provide ironclad protection, the Veritensor Enterprise Control Plane enforces security at the Linux kernel level. The Celery worker containers responsible for archive extraction are deployed with a read_only: true root filesystem and a strict tmpfs (RAM disk) mount limited to 2GB (/tmp:exec,size=2G).

If an advanced Zip Bomb bypasses the Python header checks and attempts to decompress, it can only write to the isolated 2GB RAM disk. Once the 2GB limit is reached, the OS blocks further writes, gracefully neutralizing the attack without impacting the host server's physical storage or triggering a system-wide OOM cascade.