TorchServe Management API SSRF (CVE-2023-43654)
Severity:
Critical
Summary
Invicti identified the TorchServe Management API SSRF (CVE-2023-43654) in the target web server. TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In the default configuration, TorchServe is vulnerable to an SSRF vulnerability. An attacker could exploit this vulnerability to compromise the server.
Impact
This vulnerability allows unauthenticated attackers to compromise the server.
Remediation
Set secure values for the allowed_urls option and the model URL in the TorchServe.
Required Skills for Successful Exploitation
Actions To Take
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Featured resources
Build your resistance to threats. And save hundreds of hours each month.
