关联漏洞
标题:BentoML 代码问题漏洞 (CVE-2025-32375)Description:BentoML是BentoML开源的一个开源模型服务库。用于使用 Python 构建高性能和可扩展的人工智能应用程序。 BentoML 1.4.8之前版本存在代码问题漏洞，该漏洞源于不安全的反序列化，可能导致执行任意代码。
Description
This repository includes everything needed to run a PoC exploit for CVE-2025-32375 in a Docker environment. It runs the latest vulnerable version of BentoML (1.4.7).
介绍
# Setup for the vulnerable version.
Start the vulnerable container:
```sh
docker compose up
```
Create a listener (e.g. ncat):
```sh
ncat -klnv 1337
```
Run the exploit:
```sh
python3 exploit.py
```
You should receive an HTTP request in the ncat window with the contents of the OS command (`id` by default) if everything worked as expected.
# Credits
+ Vulnerability found by [SeaW1nd](https://twitter.com/SeaW1nd1405)
+ Based on the testing setup by [VickyTheViking](https://github.com/VickyTheViking)
文件快照
[4.0K] /data/pocs/de6595faecb8ec7ecfb23e4633a6b91845279c5d
├── [ 109] docker-compose.yml
├── [ 408] Dockerfile
├── [ 534] exploit.py
├── [ 508] README.md
└── [4.0K] workdir
├── [ 172] bentofile.yaml
├── [ 246] create.py
└── [ 460] service.py
1 directory, 7 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。