CVE-2024-5452: PyTorch Lightning RCE Vulnerability

CVE-2024-5452 Overview

A critical remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the deepdiff library. The library uses deepdiff.Delta objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.

Critical Impact

This vulnerability allows unauthenticated remote attackers to achieve complete system compromise through arbitrary code execution on any self-hosted PyTorch Lightning application with default configurations, as the vulnerable delta endpoint is enabled by default.

Affected Products

• lightningai pytorch_lightning version 2.2.1
• PyTorch Lightning applications using deepdiff.Delta for state management
• Self-hosted PyTorch Lightning deployments with default configuration

Discovery Timeline

• 2024-06-06 - CVE-2024-5452 published to NVD
• 2025-10-15 - Last updated in NVD database

Technical Details for CVE-2024-5452

Vulnerability Analysis

This vulnerability is classified as an Insecure Deserialization flaw (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes, CWE-913: Improper Control of Dynamically-Managed Code Resources). The root cause lies in the interaction between PyTorch Lightning's delta processing mechanism and the deepdiff library's handling of Python dunder (double underscore) attributes.

The attack exploits a fundamental weakness in how the application trusts deserialized data from frontend requests. While the application implements a deserializer whitelist intended to prevent dangerous operations, attackers can craft malicious payloads that circumvent these restrictions by embedding dunder attributes within serialized delta objects.

Once the malicious delta passes through the whitelist validation, the attacker gains the ability to manipulate Python's object model through dunder attributes like __class__, __globals__, __import__, and similar introspection mechanisms. This provides a pathway to access arbitrary modules, classes, and object instances within the Python runtime environment.

Root Cause

The vulnerability stems from insufficient validation of deserialized deepdiff.Delta objects, specifically the failure to properly sanitize or block dunder attributes within serialized payloads. The deserializer whitelist implementation contains a bypass that allows carefully constructed payloads containing dunder attributes to pass validation checks. This architectural flaw enables attackers to manipulate Python's object model and achieve arbitrary code execution.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious serialized delta payload containing embedded dunder attributes
2. Sending the payload to the delta endpoint (enabled by default on PyTorch Lightning applications)
3. Bypassing the deserializer whitelist through payload manipulation
4. Leveraging dunder attribute access to traverse Python's object hierarchy
5. Executing arbitrary code through module imports or function calls

The following patch shows part of the security fix applied to address this vulnerability:

 import glob
 import logging
 import os
-import pathlib
 import re
 import shutil
-import tarfile
 import tempfile
 import urllib.request
 from distutils.version import LooseVersion

Source: GitHub Commit Update

Detection Methods for CVE-2024-5452

Indicators of Compromise

• Unusual HTTP POST requests to delta-related endpoints containing serialized Python objects
• Log entries showing unexpected access to __class__, __globals__, __import__, or other dunder attributes
• Process spawning anomalies from the PyTorch Lightning application process
• Unexpected outbound network connections from the application server

Detection Strategies

• Implement application-layer monitoring to inspect incoming serialized payloads for dunder attribute patterns
• Deploy web application firewall (WAF) rules to detect and block requests containing suspicious Python serialization patterns
• Monitor application logs for deserialization errors or warnings related to attribute access
• Enable runtime application self-protection (RASP) to detect object traversal attacks

Monitoring Recommendations

• Configure alerting for any delta endpoint access from unexpected IP ranges or geographic locations
• Implement anomaly detection on the volume and pattern of requests to state modification endpoints
• Set up file integrity monitoring on the PyTorch Lightning application directory
• Monitor system calls for unexpected process execution originating from the Python application

How to Mitigate CVE-2024-5452

Immediate Actions Required

• Update PyTorch Lightning to the latest patched version immediately
• Disable the delta endpoint if not required for application functionality
• Implement network segmentation to limit access to self-hosted PyTorch Lightning instances
• Review application logs for any historical exploitation attempts

Patch Information

Lightning AI has released a security patch to address this vulnerability. The fix is available in commit 330af381de88cff17515418a341cbc1f9f127f9a. Organizations should update to a version containing this patch. For detailed patch information, refer to the GitHub Commit Update and the Huntr Bug Bounty Report.

Workarounds

• Disable the delta endpoint by modifying the application configuration if the feature is not required
• Implement strict network access controls to limit who can reach the PyTorch Lightning application
• Deploy a reverse proxy with request filtering to block payloads containing dunder attributes
• Run the application in a sandboxed environment with restricted system access

# Configuration example - Restrict network access to PyTorch Lightning application
# Using iptables to limit access to trusted IP ranges only
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Consider running in a container with reduced privileges
docker run --read-only --cap-drop=ALL --security-opt=no-new-privileges pytorch-lightning-app