BentoML Runner Server Deserialization Vulnerability Allowing Arbitrary Code Execution

A deserialization vulnerability has been identified in BentoML's runner server, specifically in versions of BentoML through 1.3.4.post1. This vulnerability allows an attacker to execute unauthorized arbitrary code on the server by manipulating certain parameters. The issue arises when the 'args-number' parameter is set to a value greater than 1, which triggers automatic deserialization and the execution of arbitrary code.

Impact

Exploitation of this vulnerability allows for unauthorized arbitrary code execution on the server where BentoML is running.

Reproduction

To reproduce this vulnerability, send a request to the BentoML runner server with the 'args-number' parameter set to a value greater than 1. This will trigger the deserialization process, leading to arbitrary code execution on the server.