CVE-2024-34072

Unsafe deserialization in sagemaker-python-sdk may lead to remote code execution.

• CVSS 7.8
• CWE-502
• Input Validation and Sanitization
• Remote

sagemaker-python-sdk is a library for training and deploying machine learning models on Amazon SageMaker. The sagemaker.base_deserializers.NumpyDeserializer module before v2.218.0 allows potentially unsafe deserialization when untrusted data is passed as pickled object arrays. This consequently may allow an unprivileged third party to cause remote code execution, denial of service, affecting both confidentiality and integrity. Users are advised to upgrade to version 2.218.0. Users unable to upgrade should not pass pickled numpy object arrays which originated from an untrusted source, or that could have been tampered with. Only pass pickled numpy object arrays from trusted sources.

CVE

CVE-2024-34072

CWE

CWE-502

CVSS base score

7.8

Published

2024-05-03

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

sagemaker-py

Fixed by upgrading

Yes

Solution

Upgrade to sagemaker-python-sdk version 2.218.0 or later.

import numpy as np
import pickle
from sagemaker.base_deserializers import NumpyDeserializer

def deserialization(pickled_data):
    """Vulnerable function that demonstrates the security issue."""
    return pickle.loads(pickled_data)

data = b"cos\nsystem\n(S'echo Vulnerable!'\n)"
pickled_data = pickle.dumps(np.array([1, 2, 3]))

result = deserialization(pickled_data)
print(result)

import numpy as np
import pickle
from sagemaker.base_deserializers import NumpyDeserializer

def deserialization(pickled_data):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents deserialization
    try:
        if isinstance(pickled_data, bytes):
            data = pickle.loads(pickled_data, fix_imports=True)
            if isinstance(data, np.ndarray):
                return data
            else:
                raise ValueError("Deserialized data is not a numpy array")
        else:
            raise ValueError("Untrusted data source")
    except Exception as e:
        raise ValueError(f"Deserialization failed: {str(e)}")

data = b"cos\nsystem\n(S'echo Vulnerable!'\n)"
pickled_data = pickle.dumps(np.array([1, 2, 3]))

result = deserialization(pickled_data)
print(result)

b"cos\nsystem\n(S'echo Vulnerable!'\n)"

@misc{vaitp:cve202434072,
  title        = {{Unsafe deserialization in sagemaker-python-sdk may lead to remote code execution.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-34072},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-34072/}}
}