TorchServe ShellTorch SSRF -> RCE (allowed_urls bypass)
Date: 2023-10
Affected: TorchServe < 0.8.2
Attack vector: ssrf
Category: real-world
Severity: Critical
CVE: CVE-2023-43654
CWE: CWE-918
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

TorchServe accepted all domains as valid model-loading URLs by default; combined with the management interface being exposed without auth, attackers can upload malicious models from any domain (SSRF) leading to RCE. Part of the ShellTorch chain.


Mitigations:

Architectural layers (MAESTRO):