BentoML (bentoml build, symlink dereferencing in the build context): bentoml build follows symlinks inside the build

Impact

bentoml build follows symlinks inside the build context and copies the target's contents into the bento. A symlink planted in an untrusted repository pulls whatever the builder can read - config files, tokens, key material - into the packaged artifact without the builder noticing.

Who can reach it

A victim who runs bentoml build against an attacker-supplied repository or build context. Local to the build machine.

What to do

Upgrade BentoML to 1.4.39 or later. Until then, build only in a container whose filesystem contains nothing you would not ship, and inspect the file list of bentos built from third-party sources before distributing them.

References