# Hydra instantiate() Target Hijack to Process Execution

- **Severity:** High
- **Signature ID:** `3f9c7b41-0a2e-4d16-9b8c-7e5a1c26d4f0`

## Summary

Hydra, a Python configuration framework, lets a config value called '_target_' name a function or class to instantiate. If an attacker can influence that config - through a CLI override, a local YAML file, or a downloaded artifact - they can point it at os.system or a similar call and get code execution when the job runs.

## How the attack works

An attacker gains control over some part of the Hydra configuration: a command-line override, a config file on disk, or a directory pulled in earlier in a pipeline. Hydra's instantiate()/get_method resolves the '_target_' value and calls it, and if that value is os.system, os.popen, or subprocess.Popen with attacker-supplied arguments, the interpreter spawns a shell command. The detection traces the spawned process back through its parent chain to find the Python interpreter whose own command line shows Hydra config control (a suspicious _target_, config-path/config-name flags, or override syntax), then checks that the resulting spawned command is dangerous or clearly injected rather than a normal job launch.

## Why it matters

An attacker who can influence Hydra config input - not necessarily over the network - can achieve arbitrary command execution inside the job or pipeline that runs the config, potentially leading to full compromise of that host or environment.

## What you can do

- Treat Hydra config sources (CLI overrides, config files, searchpath directories) as untrusted input and validate or restrict who can supply them, especially in shared pipelines.
- Avoid allowing '_target_' values to be set from user-controlled or externally-sourced config; restrict it to a fixed allowlist of safe callables where possible.
- Review any job that composes Hydra config from a previous pipeline step or downloaded artifact, and audit that step for tampering.
- When investigating an alert, check whether the flagged command is a known launcher plugin (submitit, ray, joblib, rq) wrapping a legitimate job in a shell, versus an unexpected or injected payload.

## Known benign look-alikes

- Hydra launcher plugins (submitit/slurm, ray, joblib, rq) legitimately wrap job submission in `sh -c`. Those payloads are plain interpreter invocations and do not match the dangerous-payload list, so they are dropped by the script.
- Legitimate setup steps in a Hydra-launched training script that download an artifact and mark it executable (`sh -c "curl ... && chmod +x ..."`). These do match the payload list and will be reported; the chain's config-source stage shows whether the config came from an untrusted directory.
- Advanced but benign configs that resolve callables via `hydra.utils.get_method` or `_target_=builtins.<fn>` for factory patterns.
- CI/notebook pipelines that pass a shell snippet through a Hydra override (`+cmd="..."`) and then execute it deliberately.
- Security research or CVE reproduction in a sandbox using `_target_=os.system`.

## References

- https://hydra.cc/docs/advanced/instantiate_objects/overview/
- https://owasp.org/Top10/A03_2021-Injection/
- https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/
- https://attack.mitre.org/techniques/T1059/006/

---
Source: https://www.netzilo.com/threats/hydra-instantiate-target-rce