Vulnerability Details
Basic Information
| Title | Exploit for Deserialization of Untrusted Data in Bentoml |
|---|---|
| Type | githubexploit |
| Published | 2025-05-03T19:04:22 |
| Last Seen | 2025-05-04T09:03:47 |
| CVSS Score | 9.8 (CRITICAL) |
CVSS v3 Details
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
CVE Information
| CVE IDs | CVE-2025-32375 |
|---|---|
| CWE | |
| Bulletin Family | exploit |
Description
# Setup for the vulnerable version.
Start the vulnerable container:
“`sh
docker compose up
“`
Create a listener (e.g. ncat):
“`sh
ncat -klnv 1337
“`
Run the exploit:
“`sh
python3 exploit.py
“`
You should receive an HTTP request in the ncat window with the contents of the OS command (`id` by default) if everything worked as expected.
# Credits
+ Vulnerability found by [SeaW1nd](https://twitter.com/SeaW1nd1405)
+ Based on the testing setup by [VickyTheViking](https://github.com/VickyTheViking)
Impact Assessment
| Base Score | 9.8 |
|---|---|
| Severity | CRITICAL |