CVE-2024-1748: Autoprognosis RCE Vulnerability

CVE-2024-1748 Overview

CVE-2024-1748 is an insecure deserialization vulnerability in van der Schaar LAB AutoPrognosis version 0.1.21. The flaw resides in the load_model_from_file function within the Release Note Handler component. An attacker can craft a malicious serialized model file that triggers unsafe deserialization when loaded by the application. The vulnerability is classified under CWE-502: Deserialization of Untrusted Data. Exploitation requires user interaction to load the attacker-supplied file, and the attack complexity is high. The exploit details have been disclosed publicly through VulDB identifier VDB-254530. The vendor was contacted before disclosure but did not respond.

Critical Impact
Successful exploitation enables arbitrary code execution in the context of the AutoPrognosis process, compromising confidentiality, integrity, and availability of the host system.

Affected Products

van der Schaar LAB AutoPrognosis 0.1.21
Component: Release Note Handler
Function: load_model_from_file

Discovery Timeline

2024-02-22 - CVE-2024-1748 published to NVD
2024-12-31 - Last updated in NVD database

Technical Details for CVE-2024-1748

Vulnerability Analysis

AutoPrognosis is an automated machine learning framework used for clinical prediction modeling. The load_model_from_file function in the Release Note Handler component deserializes Python objects from a file without validating the source or content of the serialized data. When a user loads a model file supplied by an attacker, the deserialization process can instantiate arbitrary objects and invoke methods that lead to code execution.

The issue follows the well-documented pattern of unsafe Python pickle deserialization, where the __reduce__ method of a crafted object is executed during the unpickling process. Because deserialization occurs before any integrity or type checks, an attacker controls execution flow as soon as the malicious file is parsed.

Root Cause

The root cause is the absence of input validation and signature verification on serialized model files. The function trusts file contents implicitly and reconstructs Python objects without using a safe loader or restricted unpickler. This design choice transforms model files into an arbitrary code execution vector.

Attack Vector

The attack is network-reachable but requires the victim to download and load a malicious model file into AutoPrognosis. An adversary distributes the crafted file through model sharing platforms, email, or compromised repositories. When the victim invokes load_model_from_file on the file, the embedded payload executes with the privileges of the running Python process. See the GitHub PoC Repository and VulDB #254530 for technical details.

Detection Methods for CVE-2024-1748

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter running AutoPrognosis (e.g., shells, curl, wget, powershell).
Loading of model files from untrusted directories, email attachments, or transient download locations.
Outbound network connections initiated by the AutoPrognosis process shortly after model loading.
Creation or modification of files outside the expected model directory after load_model_from_file execution.

Detection Strategies

Monitor process lineage where Python processes running AutoPrognosis spawn non-Python child processes.
Inspect serialized model files for pickle opcodes such as GLOBAL, REDUCE, or INST referencing dangerous modules like os, subprocess, or builtins.
Apply file integrity monitoring to model directories to flag unauthorized additions.

Monitoring Recommendations

Enable detailed audit logging for the Python runtime hosting AutoPrognosis, including command-line arguments and child process creation.
Alert on network egress from research and data science hosts to unexpected destinations following model load events.
Track installation and use of AutoPrognosis version 0.1.21 across the environment using software inventory tooling.

How to Mitigate CVE-2024-1748

Immediate Actions Required

Restrict use of AutoPrognosis 0.1.21 to trusted, signed model files originating from internal repositories only.
Block downloads of model files (.pkl, .pickle, .joblib) from untrusted external sources.
Run AutoPrognosis in isolated environments such as containers or virtual machines with no sensitive data access.
Educate data science teams on the risks of loading third-party serialized model artifacts.

Patch Information

No vendor patch is referenced in the NVD entry. The vendor did not respond to disclosure attempts according to the VulDB advisory. Monitor the AutoPrognosis project for security updates and consider pinning to a reviewed internal fork until an official fix is published.

Workarounds

Replace direct pickle loading with a restricted unpickler that whitelists allowed classes, or migrate to safer serialization formats such as ONNX or JSON-based model exchange.
Enforce cryptographic signature verification on model files before invoking load_model_from_file.
Apply operating system sandboxing (seccomp, AppArmor, SELinux) to limit syscalls available to the Python process loading models.
Disable or remove the Release Note Handler component if it is not required for production workflows.

bash

# Configuration example
# Verify model file signature before loading
sha256sum -c trusted_models.sha256
gpg --verify model.pkl.sig model.pkl && python -c "from autoprognosis.utils.serialization import load_model_from_file; load_model_from_file('model.pkl')"