History

Muhammad Daffa ba0171f6c4 feat: change some templates structure to make it readable and fix fastapi-dos template		2024-07-23 14:17:53 +07:00
..
README.md	April exploit release	2024-05-07 08:59:01 -07:00
bentoml-rce.yaml	feat: change some templates structure to make it readable and fix fastapi-dos template	2024-07-23 14:17:53 +07:00
bentoml_pickle_rce.py	April exploit release	2024-05-07 08:59:01 -07:00

BentoML Vulnerabilities and Exploits

BentoML is a model serving framework that offers a unified standard for AI inference, model packaging, and serving optimizations.

Vulnerabilities

Description: BentoML < 1.2.5 is vulnerable to RCE via Python object deserialization.
Impact: This vulnerability could allows an attacker to gain Remote Code Execution on the server running the BentoML inference server.

@pinkdraconian: https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68

The vulnerabilities and associated exploits provided in this repository are for educational and ethical security testing purposes only.

Contributions to improve the exploits or documentation are welcome. Please follow the contributing guidelines outlined in the repository.

All exploits and templates in this repository are released under the Apache 2.0 License.