CVE-2024-10073: FlairNLP Flair RCE Vulnerability

CVE-2024-10073 Overview

CVE-2024-10073 is a code injection vulnerability [CWE-94] in flairNLP flair version 0.14.0. The flaw resides in the ClusteringModel function within flair/models/clustering.py, which is part of the Model File Loader component. An attacker can manipulate model file loading to inject and execute arbitrary code. The vulnerability is remotely exploitable but carries high attack complexity. The exploit has been disclosed publicly, and the vendor did not respond to disclosure attempts.

Critical Impact

Successful exploitation allows remote code injection through malicious model files loaded by the ClusteringModel function, compromising the confidentiality, integrity, and availability of systems using flair 0.14.0.

Affected Products

• flairNLP flair 0.14.0
• Applications embedding the ClusteringModel loader from flair/models/clustering.py
• Machine learning pipelines that deserialize untrusted flair model files

Discovery Timeline

• 2024-10-17 - CVE-2024-10073 published to NVD
• 2024-10-29 - Last updated in NVD database

Technical Details for CVE-2024-10073

Vulnerability Analysis

The vulnerability is classified as code injection [CWE-94] affecting flair 0.14.0. The defect exists in the ClusteringModel class in flair/models/clustering.py, which acts as a Model File Loader. When the function deserializes a model file, it processes attacker-controlled content without sufficient validation. This allows arbitrary code execution in the context of the loading process. The attack is network-reachable when applications accept model files from untrusted sources. Public disclosure of the exploit increases the risk for any environment running the affected version. The vendor was contacted but did not respond, leaving the issue without an official patch.

Root Cause

The root cause is insecure deserialization within the ClusteringModel file loader. Python machine learning frameworks commonly rely on pickle-based serialization, which executes arbitrary objects upon load. The clustering.py loader does not validate or sandbox the contents of incoming model files. An attacker who controls the model file therefore controls execution.

Attack Vector

The attack vector is network-based with high complexity. An attacker crafts a malicious model file and convinces a target application or user to load it via ClusteringModel. On load, the embedded payload executes within the Python process. Exploitation requires the victim to consume an attacker-supplied model, which limits scenarios but is realistic in shared model repositories, downloads, or CI pipelines pulling third-party artifacts.

No verified proof-of-concept code is reproduced here. A public PoC has been referenced through the VulDB entry for CVE-280722 and the associated GitHub PoC repository. Review those sources for technical detail.

Detection Methods for CVE-2024-10073

Indicators of Compromise

• Unexpected child processes spawned by Python interpreters running flair workloads, particularly shells or network utilities.
• Outbound network connections originating from data science hosts shortly after model file ingestion.
• Newly written executables, scripts, or persistence artifacts in user or service account directories following a ClusteringModel load.
• Audit log entries showing flair 0.14.0 deserializing files sourced from external repositories or shared storage.

Detection Strategies

• Hunt for invocations of ClusteringModel.load or imports of flair.models.clustering paired with file paths outside trusted directories.
• Inspect Python process telemetry for pickle.loads, torch.load, or __reduce__ invocations originating from untrusted model artifacts.
• Correlate model file downloads with subsequent process creation events to surface deserialization-triggered execution.

Monitoring Recommendations

• Enable command-line and process-creation logging on machine learning hosts and forward to a centralized analytics platform.
• Alert on Python processes that initiate outbound network traffic or spawn shells immediately after file open events.
• Track installed versions of the flair package across the environment and flag any host running 0.14.0.

How to Mitigate CVE-2024-10073

Immediate Actions Required

• Inventory all systems running flair 0.14.0 and isolate workloads that consume externally sourced model files.
• Block ingestion of untrusted or unsigned model files into pipelines that use ClusteringModel.
• Run flair workloads under least-privilege service accounts with restricted filesystem and network access.
• Restrict outbound network access from model-loading hosts to only required endpoints.

Patch Information

No vendor patch has been published for CVE-2024-10073. The original reporter noted that the vendor was contacted but did not respond. Monitor the flairNLP project on GitHub for upstream fixes and consider pinning to a future patched release once available. Until then, treat model files as untrusted code.

Workarounds

• Load only model files produced internally or retrieved from cryptographically verified sources.
• Validate file hashes against a known-good allowlist before invoking ClusteringModel.
• Execute model loading inside a sandbox such as a container with no network egress and read-only filesystem mounts.
• Replace pickle-based loading with safer serialization formats where the application logic permits.

# Example: run flair workloads inside an isolated, non-privileged container
docker run --rm \
  --network=none \
  --read-only \
  --cap-drop=ALL \
  --user 65534:65534 \
  -v /opt/models/trusted:/models:ro \
  python:3.11-slim \
  python -c "from flair.models import ClusteringModel; ClusteringModel.load('/models/verified.pt')"