PT-2025-15707 · Bentoml · Bentoml
Seaw1Nd
·
Published
2025-04-09
·
Updated
2026-04-04
·
CVE-2025-32375
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BentoML versions 1.0.0a1 through 1.4.7
Description
The issue is related to an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers initial access and information disclosure on the server. This can be achieved by exploiting the
Payload-Container and Payload-Meta headers, allowing attackers to execute commands such as curl and potentially gain remote shell access to the server.Recommendations
To resolve the issue, update to version 1.4.8, as this version fixes the insecure deserialization vulnerability in BentoML's runner server.
As a temporary workaround, consider restricting access to the vulnerable
runner app.py and container.py modules until a patch is available.
Avoid using the NdarrayContainer and PandasDataFrameContainer classes in the Payload-Container header, as they can be exploited to execute arbitrary code.
Restrict the use of the pickle.loads() function, which is used to deserialize payload data, to prevent the execution of malicious code.Exploit
Fix
RCE
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bentoml