BentoML (bentofile.yaml path fields: description, docker.setup_script, docker.dockerfile_template

Impact

Several bentofile path fields accept traversal, so building an attacker's bento copies arbitrary files from the builder's filesystem into the bento archive. SSH keys, cloud credential files and environment secrets ride along into an artifact that is then pushed to a registry the attacker can read - a clean supply-chain exfiltration path off a shared build host.

Who can reach it

Anyone who can get a victim to run bentoml build on their bentofile. The exfiltration completes when the resulting bento is pushed or shared.

What to do

Upgrade BentoML to 1.4.34 or later. Build untrusted bentos in an isolated container with no credential files present, and scan any bento built from an outside source before pushing it to a shared registry.

References