Hugging Face Transformers MobileViTV2 deserialization remote code execution (CVE-2024-11392)
A remote code execution vulnerability in Hugging Face Transformers MobileViTV2 allows attackers to execute arbitrary code by exploiting improper validation of configuration file deserialization. The vulnerability requires user interaction and was publicly disclosed on November 19, 2024, after the vendor rejected the report.
What happened
A remote code execution vulnerability exists in Hugging Face Transformers MobileViTV2 within the handling of configuration files. The vulnerability results from lack of proper validation of user-supplied data, which can result in deserialization of untrusted data.
Remote attackers can exploit this vulnerability to execute arbitrary code in the context of the current user, with user interaction required such as visiting a malicious page or opening a malicious file.
Reported impact
The vulnerability has a CVSS score of 7.5, indicating high severity, with potential for code execution under the privileges of the affected user.
Index analysis
ZDI reported the vulnerability to a third-party bug bounty program on August 7, 2024, which rejected the report as out of scope. After the vendor recommended an alternative platform, ZDI resubmitted on August 20, 2024.
The vendor rejected the vulnerability on October 14, 2024. ZDI notified the vendor on November 6, 2024 of intention to publish as a zero-day advisory, leading to coordinated public release on November 19, 2024.
Governance controls
The only mitigation strategy noted is to restrict interaction with the application, given the nature of the vulnerability.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.