Sploitus

Exploit for Server-Side Request Forgery in Pytorch Torchserve

CVE-2023-43654

githubexploit · 2024-05-28

Exploit Code

README28 lines
## https://sploitus.com/exploit?id=B76F88AA-89B1-56FC-84BB-5A166CC51FE1
# CVE-2023-43654

  
  
  


ShellTorch is a chain of 3 Critical Vulnerabilities in PyTorch TorchServe - the default inference server of PyTorch.
This is an End-to-End POC for an [`SSRF`](https://github.com/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w) vulnerability which leads to [`Arbitrary Remote Code Execution`](https://github.com/pytorch/serve/security/advisories/GHSA-4mqg-h5jf-j9m7) from the network



### 1. Run [`TorchServe 0.8.1`](https://github.com/pytorch/serve/tree/release_0.8.1/docker#start-a-container-with-a-torchserve-image)

```shell
docker run -d --rm -it -p 8080:8080 -p 8081:8081 -p 8082:8082 -p 7070:7070 -p 7071:7071 --name shelltorch-demo pytorch/torchserve:0.8.1-cpu

docker logs -f shelltorch-demo
```

### 2. Run the [`ShellTorch-Checker`](https://github.com/OligoCyberSecurity/ShellTorchChecker/) script
This tool is used to check if a given deployment is vulnerable to CVE-2023-43654.
```shell
bash ShellTorch Blog
* ShellTorch-Checker
* GitHub TorchServe Documentation
* Docker Hub Image