{"schema":"threatline.record/2","record":{"id":"CVE-2025-54381","aliases":["GHSA-mrmq-3q62-6cc8","PYSEC-2026-297"],"summary":"BentoML SSRF Vulnerability in File Upload Processing  ","details":"### Description\n\nThere's an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses.\n\nThe framework automatically registers any service endpoint with file-type parameters (`pathlib.Path`, `PIL.Image.Image`) as vulnerable to this attack, making it a framework-wide security issue that affects most real-world ML services handling file uploads. While BentoML implements basic URL scheme validation in the `JSONSerde` path, the `MultipartSerde` path has no validation whatsoever, and neither path restricts access to internal networks, cloud metadata endpoints, or localhost services.\n\nThe documentation explicitly promotes this URL-based file upload feature, making it an intended but insecure design that exposes all deployed services to SSRF attacks by default.\n\n### Source - Sink Analysis\n\n**Source:** User-controlled multipart form field values and JSON request bodies containing URLs\n\n**Call Chain - Path 1 (MultipartSerde - No Validation):**\n1. HTTP POST request with multipart form data to any BentoML endpoint with file-type input parameters  \n2. `MultipartSerde.parse_request()` in `src/_bentoml_impl/serde.py:202` processes the request\n3. `form = await request.form()` parses multipart data using Starlette\n4. For file-type fields: `value = [await self.ensure_file(v) for v in form.getlist(k)]` at line 209\n5. `MultipartSerde.ensure_file()` called at lines 186-200 with user-controlled string URL\n6. **Sink:** `resp = await client.get(obj)` at line 193 - Direct HTTP request with zero validation\n\n**Call Chain - Path 2 (JSONSerde - Weak Validation):**  \n1. HTTP POST request with JSON body containing URL to endpoint with `IORootModel` + `multipart_fields`\n2. `JSONSerde.parse_request()` in `src/_bentoml_impl/serde.py:157` processes the request\n3. `body = await request.body()` extracts request body\n4. Condition check: `if issubclass(cls, IORootModel) and cls.multipart_fields:` at line 164\n5. Weak validation: `if is_http_url(url := body.decode(\"utf-8\", \"ignore\")):` at line 165 (only checks scheme)\n6. **Sink:** `resp = await client.get(url)` at line 168 - HTTP request after insufficient validation\n\n### Proof of Concept\n\nCreate a BentoML service:\n```python\nfrom pathlib import Path\nimport bentoml\n\n@bentoml.service  \nclass ImageProcessor:\n    @bentoml.api\n    def process_image(self, image: Path) -> str:\n        return f\"Processed image: {image}\"\n```\n\nDeploy and exploit:\n```bash\n# Start service (binds to 0.0.0.0:3000 by default)\nbentoml serve service.py:ImageProcessor\n\n# SSRF Attack 1 - Access AWS metadata  \ncurl -X POST http://target:3000/process_image \\\n     -F 'image=http://169.254.169.254/latest/meta-data/'\n\n# SSRF Attack 2 - Internal service enumeration\ncurl -X POST http://target:3000/process_image \\  \n     -F 'image=http://localhost:8080/admin'\n\n# SSRF Attack 3 - Internal network scanning\ncurl -X POST http://target:3000/process_image \\\n     -F 'image=http://10.0.0.1:22'\n```\n\nExpected result: Server makes HTTP requests to internal/cloud endpoints, potentially returning sensitive data in error messages or logs.\n\n### Impact\n- Access AWS/GCP/Azure cloud metadata services for credential theft\n- Enumerate and interact with internal HTTP services and APIs  \n- Bypass firewall restrictions to reach internal network resources\n- Perform network reconnaissance from the server's perspective\n- Retrieve sensitive information disclosed in HTTP response data\n- Potential for internal service exploitation through crafted requests\n\n### Remediation  \n\nImplement comprehensive URL validation in both serialization paths by adding network restriction checks to prevent access to internal/private network ranges, localhost, and cloud metadata endpoints. The existing `is_http_url()` function should be enhanced to include allowlist validation rather than just scheme checking.","categories":["Libraries & packages"],"product":"bentoml","vendor":"bentoml","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mrmq-3q62-6cc8","source_modified_at":"2026-10-27T15:16:09Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"bentoml"},"range":">= 1.4.0, < 1.4.19"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-54381","source_modified_at":"2025-07-30T15:07:10.836Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"BentoML","vendor":"bentoml","versions":[{"version":">= 1.4.0, < 1.4.19","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mrmq-3q62-6cc8","source_modified_at":"2026-10-27T15:30:03.235527734Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"bentoml","ecosystem":"PyPI","purl":"pkg:pypi/bentoml"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.19"}]}],"versions":["1.4.0","1.4.1","1.4.10","1.4.11","1.4.12","1.4.13","1.4.14","1.4.15","1.4.16","1.4.17","1.4.18","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.4.7","1.4.8","1.4.9"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-mrmq-3q62-6cc8","source_modified_at":"2026-10-27T15:16:09Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"bentoml"},"version":"1.4.19"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-mrmq-3q62-6cc8","source_modified_at":"2026-10-27T15:30:03.235527734Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"bentoml","ecosystem":"PyPI","purl":"pkg:pypi/bentoml"},"version":"1.4.19"}],"cvss":9.9,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.16152,"percentile":0.96913,"score_date":"2026-10-27"},"published_at":"2025-07-29T22:11:24.407Z","modified_at":"2026-10-27T15:30:03.235527734Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-mrmq-3q62-6cc8","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:16:09Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-54381","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2025-07-30T15:07:10.836Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-mrmq-3q62-6cc8","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:30:03.235527734Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-54381","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/bentoml/BentoML/security/advisories/GHSA-mrmq-3q62-6cc8","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/bentoml/BentoML/commit/534c3584621da4ab954bdc3d814cc66b95ae5fb8","tags":["x_refsource_MISC"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54381","source":"GitHub Advisory Database"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/bentoml/PYSEC-2026-297.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/bentoml","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-mrmq-3q62-6cc8","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2025-07-30T13:32:09.733713Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T15:30:03.235527734Z","content_hash":"24a54d7d16cba0a2e3be718609eb5b8a71c24bce47648a819e9b2a2ffa90f984"}}