Server-side Request Forgery (SSRF) Affecting torchserve package, versions [,0.8.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TORCHSERVE-5925613
- published 29 Sep 2023
- disclosed 28 Sep 2023
- credit Oligo Security
Introduced: 28 Sep 2023
CVE-2023-43654 Open this link in a new tabHow to fix?
Upgrade torchserve to version 0.8.2 or higher.
Overview
torchserve is a TorchServe is a tool for serving neural net models for inference
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) due to the lack of proper input validation in the default configuration. An attacker can invoke remote HTTP download requests and write files to the disk, potentially compromising the integrity of the system and sensitive data.
Note
This is only exploitable if the default value for allowed_urls is used and the user specifies the model URL to be used. An attacker can load the model of their choice from any URL they wish to use. The impact of this vulnerability may vary based on specific configuration.