Hydra instantiate() Target Hijack to Process Execution

How the attack works

An attacker gains control over some part of the Hydra configuration: a command-line override, a config file on disk, or a directory pulled in earlier in a pipeline. Hydra's instantiate()/get_method resolves the '_target_' value and calls it, and if that value is os.system, os.popen, or subprocess.Popen with attacker-supplied arguments, the interpreter spawns a shell command. The detection traces the spawned process back through its parent chain to find the Python interpreter whose own command line shows Hydra config control (a suspicious _target_, config-path/config-name flags, or override syntax), then checks that the resulting spawned command is dangerous or clearly injected rather than a normal job launch.

Netzilo detection

Why it matters

An attacker who can influence Hydra config input - not necessarily over the network - can achieve arbitrary command execution inside the job or pipeline that runs the config, potentially leading to full compromise of that host or environment.

What you can do

• →Treat Hydra config sources (CLI overrides, config files, searchpath directories) as untrusted input and validate or restrict who can supply them, especially in shared pipelines.
• →Avoid allowing '_target_' values to be set from user-controlled or externally-sourced config; restrict it to a fixed allowlist of safe callables where possible.
• →Review any job that composes Hydra config from a previous pipeline step or downloaded artifact, and audit that step for tampering.
• →When investigating an alert, check whether the flagged command is a known launcher plugin (submitit, ray, joblib, rq) wrapping a legitimate job in a shell, versus an unexpected or injected payload.

Known benign look-alikes

• Hydra launcher plugins (submitit/slurm, ray, joblib, rq) legitimately wrap job submission in `sh -c`. Those payloads are plain interpreter invocations and do not match the dangerous-payload list, so they are dropped by the script.
• Legitimate setup steps in a Hydra-launched training script that download an artifact and mark it executable (`sh -c "curl ... && chmod +x ..."`). These do match the payload list and will be reported; the chain's config-source stage shows whether the config came from an untrusted directory.
• Advanced but benign configs that resolve callables via `hydra.utils.get_method` or `_target_=builtins.<fn>` for factory patterns.
• CI/notebook pipelines that pass a shell snippet through a Hydra override (`+cmd="..."`) and then execute it deliberately.
• Security research or CVE reproduction in a sandbox using `_target_=os.system`.

References

• https://hydra.cc/docs/advanced/instantiate_objects/overview/
• https://owasp.org/Top10/A03_2021-Injection/
• https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
• https://attack.mitre.org/techniques/T1059/006/