Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
veracodeVeracode Vulnerability DatabaseVERACODE:43511
HistoryOct 03, 2023 - 5:21 a.m.

Server Side Request Forgery (SSRF)

2023-10-0305:21:25
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
torchserve
server side request forgery
ssrf
input validation
pytorch model
remote http download requests
software

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

50.5%

JSON

torchserve is vulnerable to Server Side Request Forgery (SSRF). The vulnerability is caused by a missing input validation check in the default configuration for the property value of allowed_urls, which is used to restrict URLs used to load the PyTorch model in the application. This can lead to an attacker loading the model of their choice from any URL they wish to use resulting in a remote HTTP download requests.

CPENameOperatorVersion
torchservele0.8.1
torchservele0.8.1

Related

prion 1
osv 2
cve 1
cvelist 1
github 1
nessus 2
f5 1
nvd 1
rapid7blog 1
thn 1
zdt 1
packetstorm 1
metasploit 1
prion
prion
Default configuration
2023-09-28 23:15:00
osv
osv
TorchServe Server-Side Request Forgery vulnerability
2023-10-02 20:39:20
CVE-2023-43654
2023-09-28 23:15:09
cve
cve
CVE-2023-43654
2023-09-28 23:15:09
cvelist
cvelist
CVE-2023-43654 TorchServe Server-Side Request Forgery
2023-09-28 22:10:09
github
github
TorchServe Server-Side Request Forgery vulnerability
2023-10-02 20:39:20
nessus
nessus
PyTorch TorchServe SSRF (CVE-2023-43654)
2023-10-31 00:00:00
PyTorch TorchServe < 0.8.2 SSRF
2023-10-31 00:00:00
f5
f5
K000138582 : TorchServe vulnerability CVE-2023-43654
2024-02-13 00:00:00
nvd
nvd
CVE-2023-43654
2023-09-28 23:15:09
rapid7blog
rapid7blog
Metasploit Weekly Wrap-Up
2023-10-13 17:03:36
thn
thn
Warning: PyTorch Models Vulnerable to Remote Code Execution via ShellTorch
2023-10-03 16:24:00
zdt
zdt
PyTorch Model Server Registration / Deserialization Remote Code Execution Exploit
2023-10-15 00:00:00
packetstorm
packetstorm
PyTorch Model Server Registration / Deserialization Remote Code Execution
2023-10-13 00:00:00
metasploit
metasploit
PyTorch Model Server Registration and Deserialization RCE
2023-10-12 13:27:26

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

50.5%

JSON
Related for VERACODE:43511
prion1osv2cve1cvelist1github1nessus2f51nvd1rapid7blog1thn1zdt1packetstorm1metasploit1