PT-2025-31269 · Bentoml · Bentoml
Geckosecurity
+2
·
Published
2025-07-29
·
Updated
2025-10-15
·
CVE-2025-54381
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
BentoML versions 1.4.0 through 1.4.19
Description
BentoML contains a Server-Side Request Forgery (SSRF) issue in the file upload processing system. This allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. The vulnerability exists in the serialization/deserialization handlers, specifically in
MultipartSerde.parse request() and JSONSerde.parse request(). The MultipartSerde path lacks validation, while the JSONSerde path has weak validation, only checking the URL scheme.API Endpoints: Any BentoML endpoint with file-type input parameters.
Vulnerable Parameters or Variables:
image (in the proof of concept), user-controlled URLs in multipart form fields and JSON request bodies.
Function Names: MultipartSerde.parse request(), MultipartSerde.ensure file(), JSONSerde.parse request().Recommendations
Update to BentoML version 1.4.19 or later.
Implement comprehensive URL validation in both serialization paths.
Add network restriction checks to prevent access to internal/private network ranges, localhost, and cloud metadata endpoints.
Enhance the
is http url() function to include allowlist validation instead of just scheme checking.Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bentoml