CVE-2024-35198: PyTorch TorchServe Auth Bypass Vulnerability

CVE-2024-35198 Overview

CVE-2024-35198 is a security bypass vulnerability in TorchServe, a flexible and easy-to-use tool for serving and scaling PyTorch models in production. The vulnerability allows attackers to bypass the allowed_urls configuration check by including path traversal characters such as .. in URLs. While TorchServe's security check fails to prevent malicious URLs, it does not stop the model from being downloaded into the model store. Once downloaded, the file can be referenced without providing a URL, effectively circumventing the security controls designed to restrict model sources.

Critical Impact

This vulnerability enables attackers to bypass URL validation controls, potentially allowing the download and execution of malicious PyTorch models from untrusted sources, leading to remote code execution in production ML inference environments.

Affected Products

• PyTorch TorchServe versions prior to 0.11.0
• Self-hosted TorchServe deployments with allowed_urls configuration
• Note: Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected

Discovery Timeline

• 2024-07-19 - CVE CVE-2024-35198 published to NVD
• 2025-09-04 - Last updated in NVD database

Technical Details for CVE-2024-35198

Vulnerability Analysis

This vulnerability stems from insufficient URL validation in TorchServe's model download mechanism. The allowed_urls configuration is designed to restrict which external sources can be used to download models, providing a security boundary to prevent loading of untrusted or malicious model files. However, the validation logic fails to properly sanitize URLs containing path traversal sequences.

When a URL containing characters like .. is submitted, the initial security check may be bypassed, but the download operation proceeds successfully. The downloaded file is stored in the model store, and subsequent requests can reference this file directly without re-validation. This creates a persistent bypass of the security controls, as the malicious model remains accessible for inference operations.

The vulnerability is classified under CWE-706 (Use of Incorrectly-Resolved Name or Reference), indicating that the URL resolution process does not correctly handle path manipulation attempts, leading to security control bypass.

Root Cause

The root cause lies in the URL validation logic that checks against the allowed_urls whitelist. The validation fails to normalize or properly sanitize URLs before comparison, allowing path traversal characters to manipulate the URL in ways that bypass the security check while still resolving to the intended malicious target. The two-phase nature of the vulnerability—where downloads succeed despite failed validation—indicates a disconnect between the validation and download code paths.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with access to the TorchServe management API can craft a malicious URL containing path traversal sequences such as .. to bypass the allowed_urls restrictions. The attack flow follows these steps:

1. Attacker identifies a TorchServe instance with allowed_urls restrictions configured
2. Attacker crafts a URL containing path traversal characters that bypasses validation but still resolves to a malicious model hosting location
3. The model is downloaded into the model store despite the validation being intended to block it
4. On subsequent requests, the attacker references the downloaded model directly, executing the malicious payload during inference

Since PyTorch models can contain arbitrary Python code executed during model loading and inference, successful exploitation can lead to remote code execution on the TorchServe host.

Detection Methods for CVE-2024-35198

Indicators of Compromise

• Unexpected model files appearing in the TorchServe model store directory
• Model download requests containing path traversal sequences (.., %2e%2e) in URLs
• API requests to register models from URLs not in the allowed_urls configuration
• Unusual outbound network connections from TorchServe to unexpected external hosts

Detection Strategies

• Monitor TorchServe management API logs for model registration requests containing suspicious URL patterns
• Implement network-level monitoring for outbound connections from TorchServe hosts to unknown or unauthorized endpoints
• Deploy file integrity monitoring on the model store directory to detect unexpected model additions
• Review audit logs for model registration events that don't match approved model sources

Monitoring Recommendations

• Enable verbose logging on TorchServe management API endpoints
• Configure network security groups or firewalls to log and alert on outbound connections from inference servers
• Implement real-time alerting for any changes to the model store directory
• Correlate model registration events with approved change management records

How to Mitigate CVE-2024-35198

Immediate Actions Required

• Upgrade TorchServe to version 0.11.0 or later immediately
• Audit the model store directory for any unexpected or unauthorized model files
• Review management API access logs for suspicious model registration attempts
• Restrict network access to the TorchServe management API to authorized administrators only

Patch Information

The PyTorch team has addressed this vulnerability in TorchServe release 0.11.0. The fix, implemented in PR #3082, validates URLs by rejecting those containing path traversal characters such as .. before initiating the download process. Users should upgrade to the latest TorchServe release to receive this security fix. Additional details are available in the GitHub Security Advisory.

Workarounds

• There are no known workarounds for this vulnerability
• The only recommended mitigation is upgrading to TorchServe version 0.11.0 or later
• As a defense-in-depth measure, restrict network egress from TorchServe hosts to limit where models can be downloaded from
• Implement strict network segmentation to limit access to the TorchServe management API