ART Kubeflow component vulnerable to RCE via unsafe eval()
Overview
The Adversarial Robustness Toolbox (ART), specifically versions up to and including 1.20.1, has a critical remote code execution (RCE) vulnerability within its Kubeflow integration. The function responsible for robustness evaluation of PyTorch models within ART's Kubeflow component utilizes the built-in Python `eval()` function to process user-provided strings intended for `LossFn` and `Optimizer` parameters. Crucially, these inputs are not subjected to any form of sanitization or security validation before being passed to `eval()`. This oversight allows an attacker to craft malicious strings that, when evaluated by `eval()`, execute arbitrary Python code on the host system. Successful exploitation grants the attacker the ability to perform actions with the same privileges as the ART evaluation process, potentially leading to full system compromise. This vulnerability poses a significant risk to any environment using ART for model robustness evaluations within a Kubeflow deployment.
Affected Systems
Testing Guide
1. Ensure you have a Kubeflow environment integrated with ART. 2. Create a malicious Python string that attempts to execute arbitrary code, e.g., `__import__('os').system('echo vulnerable > /tmp/art_test.txt')`. 3. Configure an ART robustness evaluation task within Kubeflow, setting the `LossFn` or `Optimizer` parameter to this malicious string. 4. Initiate the evaluation. 5. Check the target system for evidence of code execution (e.g., the creation of `/tmp/art_test.txt` or other indicators). 6. If the code executes, the system is vulnerable.
Mitigation Steps
- Update ART to a version that addresses this vulnerability. - Avoid using the Kubeflow component for robustness evaluation if an update is not immediately possible. - Implement strict input validation and sanitization on any user-supplied strings intended for `LossFn` and `Optimizer` parameters before they are processed by `eval()`. - Limit the privileges of the ART evaluation process to the principle of least privilege. - Consider replacing `eval()` with safer alternatives for parameter processing, such as using predefined configuration objects or whitelisted values.
Patch Details
The specific patch version is not detailed in the provided CVE description, but it is available in versions subsequent to 1.20.1.