CVE-2024-35198
📋 TL;DR
This vulnerability in TorchServe allows attackers to bypass URL validation checks by using directory traversal sequences like '..' in URLs, enabling them to download arbitrary models into the model store. Once downloaded, these models can be referenced without URL validation, effectively circumventing security controls. Only TorchServe users are affected; Amazon SageMaker and EKS users are not impacted.
💻 Affected Systems
- TorchServe
📦 What is this software?
Torchserve by Pytorch
⚠️ Risk & Real-World Impact
Worst Case
Attackers could download and execute malicious models leading to remote code execution, data exfiltration, or complete system compromise.
Likely Case
Unauthorized model deployment leading to service disruption, model poisoning, or data leakage from inference requests.
If Mitigated
Limited impact with proper network segmentation and strict access controls, but still vulnerable to internal threats.
🎯 Exploit Status
Exploitation requires network access to TorchServe management API and knowledge of the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.11.0
Vendor Advisory: https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2
Restart Required: Yes
Instructions:
1. Stop TorchServe service. 2. Upgrade to version 0.11.0 or later using pip: 'pip install torchserve==0.11.0'. 3. Restart TorchServe service.
🔧 Temporary Workarounds
No workarounds available
allThe vendor states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict network access to TorchServe management API to trusted sources only.
- Implement strict monitoring of model store changes and alert on unauthorized model downloads.
🔍 How to Verify
Check if Vulnerable:
Check TorchServe version: 'torchserve --version' or examine package version in Python environment.Check Version:
torchserve --versionVerify Fix Applied:
Confirm version is 0.11.0 or higher using 'torchserve --version'.📡 Detection & Monitoring
Log Indicators:
- Unusual model download requests with '..' sequences in URLs
- Unexpected model registrations in model store
Network Indicators:
- HTTP requests to TorchServe management API with directory traversal patterns
SIEM Query:
source="torchserve" AND (url="*..*" OR event="model_register")🔗 References
- https://github.com/pytorch/serve/pull/3082
- https://github.com/pytorch/serve/releases/tag/v0.11.0
- https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2
- https://github.com/pytorch/serve/pull/3082
- https://github.com/pytorch/serve/releases/tag/v0.11.0
- https://github.com/pytorch/serve/security/advisories/GHSA-wxcx-gg9c-fwp2
