bentoml OpenLLM Command Injection Vulnerability in Model Repository Directory Name Handler

A command injection vulnerability has been identified in bentoml OpenLLM version 0.6.30. The issue arises in the 'async_run_command' function within 'src/openllm/common.py', specifically in the Model Repository Directory Name Handler component. The vulnerability allows for arbitrary command execution by manipulating the 'cmd' argument, with exploitation requiring local execution. This vulnerability has been publicly disclosed.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the machine running OpenLLM.

Reproduction

To reproduce this vulnerability, create a public Git repository containing a model directory named with shell metacharacters, such as ';', '$()', or '`'. Add this repository to OpenLLM, which will clone it. When a model from this repository is served using 'openllm serve', the injected commands will be executed on the local machine. This can be verified by observing the execution of a command, such as 'whoami', which can be redirected to a file.

Remediation

Users can update to the patched version of OpenLLM, which is available in the GitHub repository.