BentoML Framework up to 1.2.4 POST Request insecure default initialization of resource

Summaryinfo

A vulnerability, which was classified as very critical, has been found in BentoML Framework up to 1.2.4. This vulnerability affects unknown code of the component POST Request Handler. Performing a manipulation results in insecure default initialization of resource. This vulnerability is known as CVE-2024-2912. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in BentoML Framework up to 1.2.4. It has been classified as very critical. This affects an unknown functionality of the component POST Request Handler. The manipulation with an unknown input leads to a insecure default initialization of resource vulnerability. CWE is classifying the issue as CWE-1188. The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.

It is possible to read the advisory at huntr.com. This vulnerability is uniquely identified as CVE-2024-2912 since 03/26/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/16/2024).

Upgrading to version 1.2.5 eliminates this vulnerability. Applying the patch fd70379733c57c6368cc022ac1f841b7b426db7b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• BentoML

Name

• Framework

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion