CVE-2025-32375 PoC — BentoML 代码问题漏洞

Description

This repository includes everything needed to run a PoC exploit for CVE-2025-32375 in a Docker environment. It runs the latest vulnerable version of BentoML (1.4.7).

介绍

# Setup for the vulnerable version.

Start the vulnerable container:
```sh
docker compose up
```

Create a listener (e.g. ncat):
```sh
ncat -klnv 1337
```

Run the exploit:
```sh
python3 exploit.py
```

You should receive an HTTP request in the ncat window with the contents of the OS command (`id` by default) if everything worked as expected.

# Credits
+ Vulnerability found by [SeaW1nd](https://twitter.com/SeaW1nd1405)
+ Based on the testing setup by [VickyTheViking](https://github.com/VickyTheViking)

文件快照

备注