writeups.xyz / Shelltorch Explained: Multiple Vulnerabilities in Pytorch Model Server (Torchserve) (CVSS 9.9, CVSS 9.8) Walkthrough

Submitter : c2a

Date: 8 July 2024

Bounty : undisclosed

Vulnerabilities :

• AI
• LLM
• RCE
• SSRF
• Insecure Deserialization
• Zip Slip Attack
• Path Traversal

Programs :

• PyTorch
• AWS
• Google
• Meta TorchServe
• SnakeYAML

Authors :

• Gal Elbaz
• Uri Katz
• Guy Kaplan
• Avi Lumelsky

Link :
https://www.oligo.security/blog/shelltorch-explained-multiple-vulnerabilities-in-pytorch-model-server