Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in Upsonic, specifically within the add_tool endpoint, which defaults to TCP port 7541. This issue arises from inadequate validation of user-supplied data, allowing for the deserialization of untrusted data. As a result, remote attackers can execute arbitrary code on affected installations, with no authentication required, in the context of the service account.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed under the service account's privileges.

Remediation

The primary mitigation strategy is to limit interactions with the Upsonic application.