ShellTorch
- Product
- PyTorch (Meta / AWS) TorchServe
- CVE
- CVE-2023-43654CVE-2022-1471
- Disclosed
- 2023-10-03
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- TorchServe 0.3.0 through 0.8.1 (SSRF present since earlier releases)
- Fixed
- TorchServe 0.8.2
Summary
Oligo Security showed that TorchServe's management API was often exposed without authentication and would download models from any URL. Combined with an unsafe SnakeYAML deserialization in model configuration, this gave remote code execution on AI model-serving infrastructure, including some cloud provider images.
Root cause
The management API (port 8081) registers models from a URL, and the allowed_urls default accepted any domain, giving SSRF and attacker-controlled model archives (CVE-2023-43654). Some official images also bound the management API to 0.0.0.0. Model archives and configs parsed with a vulnerable SnakeYAML (CVE-2022-1471) let YAML tags instantiate arbitrary Java classes, and malicious model files themselves can run code.
Impact
Unauthenticated code execution on TorchServe hosts, with access to models and training data.
Detection
Find TorchServe management APIs (8081) reachable from untrusted networks; check the TorchServe version and config.properties allowed_urls / management_address; watch for unexpected model registrations.
Mitigation
Upgrade to 0.8.2+, bind management_address to 127.0.0.1, and restrict allowed_urls to trusted model sources.