BentoML >=1.3.4 <1.4.3 - Unauthenticated Remote Code Execution via Insecure Deserialization
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2025-27520.
PoCs published by electricsheep08, Evillm, amalpvatayam67, including Metasploit module exploits/linux/http/bentoml_rce_cve_2025_27520.
AI-analyzed exploit summary This exploit leverages an insecure deserialization vulnerability in BentoML's `serde.py` to achieve unauthenticated remote code execution (RCE) via a malicious pickle payload. The PoC crafts a reverse shell using `os.system` and sends it to the target's `/summarize` endpoint with a custom content-type header.
Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.
Exploits (4)
This exploit leverages an insecure deserialization vulnerability in BentoML's `serde.py` to achieve unauthenticated remote code execution (RCE) via a malicious pickle payload. The PoC crafts a reverse shell using `os.system` and sends it to the target's `/summarize` endpoint with a custom content-type header.
This repository contains a safe educational simulation of CVE-2025-27520, demonstrating a deserialization vulnerability via a Flask-based service and a Python scanner. The PoC creates a file-based evidence instead of executing arbitrary commands, ensuring safety.
This repository contains a working proof-of-concept for CVE-2025-27520, demonstrating an insecure deserialization vulnerability in a BentoML-style application. The exploit leverages Python's pickle module to achieve remote code execution (RCE) via a crafted base64-encoded payload.
This Metasploit module exploits an insecure deserialization vulnerability in BentoML v1.4.2, allowing unauthenticated RCE via a crafted pickle payload sent to a vulnerable API endpoint.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H