PT-2025-12264 · Bentoml · Bentoml

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-9070

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bentoml/bentoml versions prior to 1.3.4.post1

Description A deserialization issue exists in the BentoML runner server. By configuring specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The issue is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.

Recommendations For versions prior to 1.3.4.post1, update to version 1.3.4.post1 or later to resolve the issue. As a temporary workaround, consider restricting the args-number parameter to a value of 1 or less to prevent automatic deserialization and arbitrary code execution.

Fix

Deserialization of Untrusted Data

Command Injection

Weakness Enumeration

CWE-502

CWE-77

Related Identifiers

CVE-2024-9070

GHSA-9G44-GWVM-HC44

Affected Products

Bentoml

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-9070 · Security Note
• https://osv.dev/vulnerability/GHSA-9g44-gwvm-hc44 · Vendor Advisory
• https://github.com/bentoml/BentoML · Note
• https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/server/runner_app.py#L301 · Note
• https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/server/runner_app.py#L297 · Note
• https://twitter.com/CveFindCom/status/1902670155555213648 · Twitter Post
• https://twitter.com/CVEnew/status/1902671141560615331 · Twitter Post
• https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5 · Note