CVE-2024-35198

What it actually does

The allowed_urls configuration check can be bypassed using path traversal characters such as ".." in a URL, permitting download of arbitrary models into the model store; subsequent references to the downloaded model succeed without re-performing the URL validation.

Why it matters to the business

Attackers can introduce and execute unauthorized models in production inference workloads, risking model tampering, data exfiltration, or remote code execution with high operational impact; prevalence across PyTorch serving deployments increases exposure surface.

How an attack unfolds

An attacker supplies a crafted URL containing ".." that evades the allow-list check, causing TorchServe to fetch and store a malicious model; the model is then referenced by name on a second request, bypassing the original security control and allowing the attacker-controlled model to be loaded and executed.

How to fix it

Upgrade pytorch/serve to the version containing commit 34bc370174c7aa4588889b344ca9b5e48ff47a89 (TorchServe 0.11.0) which validates URLs for traversal characters before any download occurs; no workarounds exist.

How to confirm the fix worked

Confirm the running TorchServe binary or container image contains commit 34bc370174c7aa4588889b344ca9b5e48ff47a89; attempt a download request containing ".." and verify it is rejected before any file is written to the model store.

Typical attack path

1. Locate a TorchServe instance exposing the model download or management endpoint
2. Submit a download request whose URL embeds path traversal sequences such as ".."
3. Confirm the model file is written to the model store despite the allow-list
4. Issue a subsequent load or inference request that references the newly downloaded model by name
5. Execute attacker-supplied model code or weights

How to detect it

Inspect TorchServe access and download logs for any URL containing the literal sequence ".."; review the model store directory for files whose names or paths do not match previously approved sources; correlate model load events that lack a preceding validated download record.

• .. in model download URL
• model store file written without matching allowed_urls entry
• inference request referencing a model absent from prior validated downloads

What your security team should do

• Immediately upgrade all TorchServe deployments to the fixed commit or release 0.11.0
• Audit existing allowed_urls lists and enforce strict allow-listing without relying solely on substring checks
• Add network egress controls or URL proxying to limit reachable model sources
• Enable verbose logging of all model download and load events for forensic review