PT-2024-22740 · Bentoml · Bentoml

Published 2024-04-15 · Updated 2024-05-22 · CVE-2024-2912

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BentoML (affected versions not specified)

Description An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2024-2912

GHSA-HVJ5-MVW9-93J3

Affected Products

Bentoml

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-2912 · Security Note
• https://osv.dev/vulnerability/GHSA-hvj5-mvw9-93j3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2912 · Vendor Advisory
• https://github.com/bentoml/BentoML · Note
• https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b · Note
• https://twitter.com/the_yellow_fall/status/1785488474688381259 · Twitter Post
• https://t.me/cvenotify/80712 · Telegram Post
• https://twitter.com/huntr_ai/status/1793341049655480466 · Twitter Post
• https://twitter.com/fletch_ai/status/1785927376712745172 · Twitter Post
• https://twitter.com/CVEnew/status/1780039198839595015 · Twitter Post
• https://twitter.com/Dinosn/status/1785502049674616963 · Twitter Post
• https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68 · Note
• https://twitter.com/fridaysecurity/status/1785488819677954500 · Twitter Post
• https://t.me/pentestingnews/46458 · Telegram Post