CVE-2024-49048: Microsoft TorchGeo RCE Vulnerability

CVE-2024-49048 Overview

CVE-2024-49048 is a remote code execution vulnerability affecting Microsoft TorchGeo, a PyTorch domain library for geospatial data. The flaw is classified under [CWE-94] (Improper Control of Generation of Code) and allows attackers to execute arbitrary code within the context of the TorchGeo process. Microsoft published the advisory on November 12, 2024.

TorchGeo is widely used in machine learning pipelines that process geospatial datasets, satellite imagery, and remote sensing data. Successful exploitation can compromise data science workloads, model training environments, and any downstream systems that ingest TorchGeo outputs.

Critical Impact
Remote attackers can achieve code execution on systems running vulnerable TorchGeo versions, leading to full confidentiality, integrity, and availability compromise of the host process.

Affected Products

Microsoft TorchGeo (all versions prior to the November 2024 security update)
Python environments and ML pipelines embedding TorchGeo
Downstream geospatial data processing workflows relying on TorchGeo

Discovery Timeline

2024-11-12 - CVE-2024-49048 published to NVD and Microsoft Security Response Center advisory released
2024-11-18 - Last updated in NVD database

Technical Details for CVE-2024-49048

Vulnerability Analysis

The vulnerability is a code injection flaw (CWE-94) in Microsoft TorchGeo. An unauthenticated attacker can trigger remote code execution over the network by supplying crafted input that TorchGeo processes during dataset, model, or configuration handling. Exploitation requires no privileges and no user interaction, though the attack complexity is high because specific conditions must be met for the exploit to succeed reliably.

The EPSS probability is 1.221% (64th percentile), indicating moderate exploitation likelihood relative to other published CVEs. Microsoft has not reported in-the-wild exploitation, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is improper control of code generation, where TorchGeo evaluates or loads attacker-controlled input without sufficient sanitization. This pattern is common in Python ML libraries that deserialize objects, load pretrained weights, or dynamically import modules from remote or untrusted sources. The Microsoft advisory does not publicly disclose the exact vulnerable function or parameter.

Attack Vector

The attack vector is network-based. An attacker delivers a malicious dataset, model file, configuration, or URL that the TorchGeo library processes. When the vulnerable code path executes, attacker-supplied code runs with the privileges of the Python interpreter hosting TorchGeo. In ML pipelines this often means access to training data, credentials, cloud API keys, and adjacent compute resources.

No public proof-of-concept exploit code is currently available. Refer to the Microsoft Security Update CVE-2024-49048 advisory for technical details.

Detection Methods for CVE-2024-49048

Indicators of Compromise

Unexpected child processes spawned by Python interpreters running TorchGeo workloads, such as shells, curl, wget, or compiler invocations
Outbound network connections from data science hosts to unfamiliar domains following dataset or model loading operations
Modification of files outside the TorchGeo working directory, including writes to ~/.ssh/, cron entries, or systemd unit files
Anomalous CPU or GPU utilization patterns inconsistent with normal training or inference workloads

Detection Strategies

Inventory all systems and container images that include the torchgeo Python package and identify their installed versions
Hunt for Python processes loading remote or untrusted .pth, .pt, or pickle files from non-allowlisted sources
Correlate TorchGeo execution with subsequent process creation, network egress, and filesystem changes to surface injection behavior
Apply MITRE ATT&CK mappings T1059.006 (Python) and T1203 (Exploitation for Client Execution) when building detections

Monitoring Recommendations

Enable command-line and process-tree logging on hosts running ML workloads and forward to a centralized analytics platform
Monitor pip installation events and Python virtual environments for unauthorized TorchGeo installations or downgrades
Alert on TorchGeo processes establishing outbound connections to non-corporate destinations, especially raw IP addresses
Audit access to model registries, dataset storage buckets, and notebook environments where TorchGeo executes

How to Mitigate CVE-2024-49048

Immediate Actions Required

Upgrade TorchGeo to the patched release referenced in the Microsoft Security Update CVE-2024-49048 advisory
Audit all Python environments, Jupyter notebooks, and container images for vulnerable torchgeo versions and remediate them
Restrict TorchGeo processes from loading datasets, weights, or configurations sourced from untrusted networks or users
Rotate credentials and API keys exposed to environments where TorchGeo processed untrusted input

Patch Information

Microsoft published the security advisory and fix guidance at Microsoft Security Update CVE-2024-49048. Administrators should upgrade torchgeo using pip install --upgrade torchgeo to the fixed version and rebuild any container images or ML runtime templates that bundle the library.

Workarounds

Isolate TorchGeo workloads inside sandboxed containers with no outbound internet access and least-privilege service accounts
Validate and pin checksums of all model files, datasets, and pretrained weights before loading them into TorchGeo
Disable or block ingestion of remote URLs in TorchGeo dataset loaders until the patched version is deployed
Apply network egress filtering on ML training hosts to limit lateral movement if exploitation occurs

bash

# Configuration example: upgrade TorchGeo and verify the installed version
pip install --upgrade torchgeo
python -c "import torchgeo; print(torchgeo.__version__)"

# Optional: pin a known-good version in requirements.txt
# torchgeo==<patched-version>