Vulnerability Report

CVE-2023-43654

Title: Pytorch Torchserve Server-Side Request Forgery (SSRF)

Server-Side Request Forgery (SSRF)

Proof Of Concept

PoC Available for CVE-2023-43654

CWE Category CWE-918
Published Date Sep 28, 2023
Modified Date Nov 21, 2024
Exploit Status Available
Score 10.0 CVSS v3.1
Exploit Probability (EPSS)
90.99%

Vulnerability Summary

CVE-2023-43654: TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.

Impacted Vendors

P
pytorch 1

Reference Links

http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html https://github.com/pytorch/serve/pull/2534 https://github.com/pytorch/serve/releases/tag/v0.8.2 https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html https://github.com/pytorch/serve/pull/2534 https://github.com/pytorch/serve/releases/tag/v0.8.2 https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
10.0
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2023-43654 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/OligoCyberSecurity/CVE-2023-43654
View Code
MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.