UpTrain: authenticated remote code execution via the checks and metadata parameters on /create_project

Impact

Any user holding a valid UpTrain login can pass attacker-chosen values in the checks and metadata parameters of /create_project and have them executed as code by the process serving the dashboard — in the documented deployment, the UpTrain Docker container. That container is where evaluation runs happen, so it typically holds the model endpoints, API keys and evaluation datasets used against the fleet. No container escape is needed to take all of that, and the container becomes a launch point into whatever network the evaluation stack sits on. No patch existed as of publication, so this is an exposure to be contained rather than closed.

Who can reach it

Any authenticated UpTrain user with network reach to the dashboard backend. Authentication is required but no elevated role is — a normal account is enough.

What to do

No fix is available as of publication; version 0.7.1 and everything before it are affected. Contain instead: restrict network reach to the dashboard to a trusted set of operators, treat every UpTrain account as equivalent to shell in that container, and run the deployment in an isolated namespace with no fleet or cloud credentials mounted. If it is not actively used, retire the deployment.

References