CVE-2024-34073

What it actually does

The vulnerable sagemaker-python-sdk function `capture_dependencies` in `sagemaker.serve.save_retrive.version_1_0_0.save.utils` can pass the caller-controlled `requirements_path` parameter into operating system command execution without sufficient sanitization. If an application, notebook workflow, model packaging process, CI job, or service exposes that parameter to untrusted input, an attacker can inject shell metacharacters or additional commands and execute them with the privileges of the Python process. Successful exploitation can result in arbitrary command execution, file disclosure or modification, credential theft from the runtime environment, tampering with ML artifacts, or denial of service. The CVSS vector indicates local attack with user interaction, but in practice impact can become remote code execution when a higher-level service accepts attacker-controlled values and calls the vulnerable function.

Why it matters to the business

Organizations using affected versions of the SageMaker Python SDK in model build, packaging, deployment, automation, or developer notebook workflows risk compromise of the systems running those workflows. Consequences may include stolen cloud credentials, unauthorized access to training data or model artifacts, tampered deployments, interrupted ML operations, and broader cloud account exposure if the runtime has powerful IAM permissions. The vulnerability is not currently in the CISA Known Exploited Vulnerabilities catalog, is not known to be used in ransomware campaigns, and has low EPSS at the time of assessment, but it has been public for a long period, so exposed usages should still be remediated as part of dependency hygiene and secure ML pipeline hardening.

How an attack unfolds

An attacker first needs a path to influence the `requirements_path` argument passed to `capture_dependencies`. This could be direct code execution in a shared notebook, submission of a malicious model packaging request, control of pipeline configuration, or commit access to automation that invokes SageMaker SDK packaging functions. The attacker supplies a value that looks like a requirements file path but includes shell control characters or command substitutions. When vulnerable SDK code invokes the underlying operating system command, the injected command executes in the context of the process running the SDK. From there, the attacker can read local files, enumerate environment variables, access cloud metadata or credentials available to the process, alter generated model artifacts, install persistence in the workspace, or disrupt the job. Exploitation depends on the vulnerable function being called with an attacker-influenced non-default `requirements_path`; using the default value or upgrading removes the known unsafe path.

How to fix it

Upgrade `sagemaker-python-sdk` to version `2.214.3` or later. For source-based remediation, ensure the AWS SageMaker Python SDK code includes the fix corresponding to commit `db0830e66c721e08fb939e5690036b412cd3eafb`; GitLab downstream references identify a related fixed commit `85a92396626cc698a65afd57df80298d3439fb87`. If immediate upgrade is not possible, do not override the `requirements_path` parameter of `capture_dependencies`; use the default value only. Additionally, prevent untrusted users from supplying file paths or command-like strings to ML packaging workflows, validate paths with strict allowlists, reject shell metacharacters, run model build jobs with least-privilege IAM roles, isolate notebook and CI execution environments, and avoid placing long-lived secrets in runtime environment variables.

How to confirm the fix worked

Confirm package versions with dependency inventory tools, lockfiles, container manifests, and runtime checks such as `python -c "import sagemaker; print(sagemaker.__version__)"`; the version should be `2.214.3` or later. Search code for imports or calls involving `capture_dependencies` and verify that `requirements_path` is omitted, hardcoded to a trusted path, or strictly validated. Review `requirements.txt`, `poetry.lock`, `Pipfile.lock`, `conda` environment files, container images, notebook environments, and CI runners for affected SDK versions. Where source code is vendored, verify that the fixed commit or equivalent sanitization is present. As a functional validation, exercise model packaging flows with benign unusual path values and confirm that injected shell metacharacters are rejected or treated as literal path input rather than executed.

Typical attack path

1. Identify a workflow, notebook, API, CI job, or model packaging process that uses an affected version of `sagemaker-python-sdk`.
2. Find a way to influence the `requirements_path` parameter passed to `capture_dependencies`.
3. Submit a crafted `requirements_path` containing shell metacharacters, command separators, command substitution, or redirection.
4. Trigger the workflow so the vulnerable SDK function executes the constructed operating system command.
5. Execute attacker-controlled commands with the privileges and cloud permissions of the Python runtime.
6. Collect credentials, read or alter data/model artifacts, pivot to accessible cloud resources, or cause denial of service by terminating processes or exhausting resources.

How to detect it

Investigate both code exposure and historical execution. Review application, notebook, CI/CD, pipeline, and job logs for calls to `capture_dependencies`, especially where `requirements_path` contains shell metacharacters such as `;`, `&&`, `||`, backticks, `$()`, pipes, redirects, or newline characters. Examine shell history, process accounting, EDR telemetry, container runtime logs, notebook cell history, build logs, and cloud audit logs for unexpected commands launched by Python processes running SageMaker SDK workflows. Look for post-exploitation behavior from those runtimes, including reads of cloud credential files, calls to instance metadata endpoints, unusual AWS STS activity, unexpected package installation, outbound connections to unfamiliar hosts, model artifact changes, or job failures following malformed requirements path input. Compare timestamps of suspicious SDK executions with file modifications in model artifact directories, dependency capture output, temporary directories, and workspace locations. Because no public universal exploit string is associated with this issue, detection should focus on command-injection patterns in `requirements_path` values and anomalous child processes spawned by Python packaging jobs.

• sagemaker.serve.save_retrive.version_1_0_0.save.utils
• capture_dependencies
• requirements_path
• requirements_path=.*;
• requirements_path=.*&&
• requirements_path=.*||
• requirements_path=.*`
• requirements_path=.*$(
• requirements_path=.*|
• requirements_path=.*>
• requirements_path=.*<
• /root/.aws/credentials
• ~/.aws/credentials
• 169.254.169.254/latest/meta-data
• 169.254.169.254/latest/api/token
• python -c
• /bin/sh -c
• /bin/bash -c
• curl http://169.254.169.254
• wget http://169.254.169.254

What your security team should do

• Inventory all uses of `sagemaker-python-sdk` across notebooks, CI/CD jobs, ML pipelines, containers, and model deployment tooling.
• Prioritize upgrades to `sagemaker-python-sdk` version `2.214.3` or later anywhere untrusted users can influence model packaging parameters.
• Search source repositories for `capture_dependencies` and `requirements_path` to identify exploitable call paths.
• Apply least-privilege IAM permissions to jobs and notebooks that run ML packaging or deployment code.
• Restrict who can submit or modify pipeline configuration, notebook code, model packaging requests, and dependency files.
• Add input validation for any service or automation that accepts file path parameters used by SDK functions.
• Review logs and artifacts from shared ML workspaces for suspicious shell commands, unexpected outbound network access, or credential-access behavior.
• Rebuild container images and refresh notebook kernels or managed environments that may continue using cached vulnerable package versions.