CVE-2024-8502: AgentScope Deserialization RCE Vulnerability

CVE-2024-8502 Overview

A critical insecure deserialization vulnerability exists in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3. This vulnerability allows remote code execution (RCE) through the deserialization of untrusted data using the dill library. The flaw is present in the AgentServerServicer.create_agent method, where serialized input is processed using dill.loads, enabling attackers to execute arbitrary commands on the server without authentication.

Critical Impact
Attackers can achieve complete server compromise through unauthenticated remote code execution by sending malicious serialized payloads to the AgentScope RPC server.

Affected Products

modelscope/agentscope v0.0.6a3
AgentScope RPC Server components using RpcAgentServerLauncher
Systems utilizing AgentServerServicer.create_agent method with untrusted input

Discovery Timeline

2025-03-20 - CVE CVE-2024-8502 published to NVD
2025-03-20 - Last updated in NVD database

Technical Details for CVE-2024-8502

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The root issue lies in the AgentScope framework's handling of serialized data within its RPC (Remote Procedure Call) server implementation. When processing agent creation requests, the AgentServerServicer.create_agent method deserializes incoming data using Python's dill library without proper validation or sanitization.

The dill library extends Python's pickle module with additional serialization capabilities, but inherits the same fundamental security concern: deserialized data can include arbitrary Python objects that execute code during the deserialization process. By crafting a malicious payload that includes code execution primitives, an attacker can trigger arbitrary command execution on the target server when the payload is processed by dill.loads.

This attack requires no authentication and can be executed remotely over the network, making it particularly dangerous for exposed AgentScope deployments.

Root Cause

The vulnerability stems from the use of dill.loads() to deserialize untrusted input in the AgentServerServicer.create_agent method. The dill library, like pickle, allows arbitrary Python object serialization including callable objects and code execution primitives. When untrusted data is passed to dill.loads(), an attacker can craft a serialized payload containing malicious code that executes during the deserialization process.

The fundamental issue is trusting client-supplied serialized data without implementing proper input validation, sanitization, or using a safe serialization format like JSON for agent creation parameters.

Attack Vector

The attack vector is network-based with no authentication required. An attacker can send a specially crafted RPC request to the AgentScope server containing a malicious serialized payload. When the create_agent method processes this request and calls dill.loads() on the attacker-controlled data, the malicious payload executes arbitrary code with the privileges of the AgentScope server process.

The vulnerability manifests in the AgentServerServicer.create_agent method where user-controlled serialized data is passed directly to dill.loads(). For technical details on the vulnerability mechanics, refer to the Huntr Bug Bounty Submission.

Detection Methods for CVE-2024-8502

Indicators of Compromise

Unexpected network connections from the AgentScope server to external destinations
Unusual process spawning by the AgentScope server process
Suspicious RPC requests to the agent creation endpoint with abnormally large or encoded payloads
Anomalous system command execution traced back to the Python interpreter running AgentScope

Detection Strategies

Monitor network traffic to AgentScope RPC endpoints for unusual serialized payloads or unexpected request patterns
Implement application-level logging for all create_agent method invocations and analyze payload characteristics
Deploy intrusion detection rules to identify dill/pickle deserialization attack patterns in network traffic
Use runtime application security monitoring to detect unexpected code execution paths during deserialization

Monitoring Recommendations

Enable verbose logging for the AgentScope RPC server to capture all incoming agent creation requests
Monitor process behavior for the AgentScope server, alerting on child process spawning or network connections
Implement network segmentation to limit exposure of AgentScope RPC services
Review access logs for the RPC endpoints for signs of reconnaissance or exploitation attempts

How to Mitigate CVE-2024-8502

Immediate Actions Required

Restrict network access to AgentScope RPC services to trusted hosts only using firewall rules
Disable the RPC agent server functionality if not required for operations
Implement network segmentation to isolate AgentScope deployments from untrusted networks
Audit existing deployments for signs of compromise before applying fixes

Patch Information

At the time of publication, users should check the modelscope/agentscope GitHub repository for updated versions that address this vulnerability. The issue was reported through the Huntr Bug Bounty program. Users should upgrade to a patched version as soon as one becomes available from the vendor.

Workarounds

Implement network-level access controls to restrict RPC server access to trusted IP addresses only
Deploy a web application firewall (WAF) or reverse proxy to filter malicious serialized payloads
Consider replacing dill deserialization with a safer serialization format like JSON for agent parameters
Run the AgentScope server in a sandboxed environment with limited privileges to reduce impact of exploitation

bash

# Example: Restrict access to AgentScope RPC port using iptables
# Replace 12345 with actual RPC port and 10.0.0.0/8 with trusted network
iptables -A INPUT -p tcp --dport 12345 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 12345 -j DROP