MONAI Pre-Auth RCE via Pickle Deserialization in nnunet Postprocessing (GHSA-8f32-8649-rv87)

Vulnerability Overview This vulnerability involves the possibility of path tampering in the pickle loading process within the post-processing stage, leading to arbitrary code execution. Specifically, and are sourced from and deserialized by . If these files are tampered with, an attacker can redirect the loading to arbitrary pickle files, thereby executing arbitrary code. Impact Scope Affected Versions: MONAI 1.6.1 and earlier. Affected Components: post-processing module. Potential Risks: Attackers can tamper with the file to load malicious pickle files, resulting in arbitrary code execution on the system. Remediation 1. Restrict File Paths: - A new function has been added to ensure that the paths for and remain within the allowed directory. - A exception is raised if the path extends beyond the allowed directory. 2. Warning Messages: - When loading pickle files, a warning message is added to inform the user that the file is sourced from and is loaded without any whitelist restrictions. - The warning message includes a link to the MONAI security advisory. 3. Environment Variable Control: - A new environment variable has been introduced, allowing users to disable this warning in specific scenarios. - By default, a warning is issued when loading pickle files. 4. Test Cases: - New test cases have been added to verify the behavior of the function. - New test cases have been added to verify the warning messages when loading malicious pickle files. - New test cases have been added to verify exception handling when paths exceed the allowed directory. POC Code The following are relevant POC code snippets: The above code demonstrates how to load malicious pickle files by tampering with the file, as well as the verification test cases after remediation.

Goal Reached Thanks to every supporter — we hit 100%!

MONAI Pre-Auth RCE via Pickle Deserialization in nnunet Postprocessing (GHSA-8f32-8649-rv87)

More from this source