CVE-2024-8502: Remote Code Execution via Deserialization in modelscope/agentscope
A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution (RCE) via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using dill.loads, enabling an attacker to execute arbitrary commands on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8502?
CVE-2024-8502 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-8502?
To mitigate CVE-2024-8502, upgrade to a version of agentscope that addresses the deserialization vulnerability.
What is the impact of CVE-2024-8502?
The impact of CVE-2024-8502 includes the ability for an attacker to execute arbitrary code on affected systems.
Which versions are affected by CVE-2024-8502?
CVE-2024-8502 affects versions up to and including agentscope version 0.0.6a3.
Who is responsible for CVE-2024-8502?
CVE-2024-8502 is associated with the modelscope product and has been identified in the RpcAgentServerLauncher class.