BentoML Remote Code Execution via Insecure Deserialization
A critical remote code execution vulnerability in BentoML versions 1.3.4 through 1.4.2 allowed unauthenticated attackers to execute arbitrary code via insecure deserialization of pickle data in HTTP requests. The vulnerability was patched in version 1.4.3 by restricting the pickle media type in the main server.
What happened
An unsafe code segment in serde.py allowed insecure deserialization of pickle data from HTTP requests without validation. The vulnerability existed in BentoML versions 1.3.4 through 1.4.2.
The code accepted payload data from unauthenticated HTTP requests with the 'application/vnd.bentoml+pickle' content type and deserialized it using pickle.loads() without sanitization. A patch released in version 1.4.3 restricts the pickle media type to non-main server instances.
Reported impact
Any unauthenticated user could execute arbitrary code on the server by sending a maliciously crafted serialized payload.
Governance controls
BentoML released version 1.4.3 with a fix that raises an error when the 'application/vnd.bentoml+pickle' media type is used in the main server.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.