Remote Code Execution via Remote Model Loading in Rasa

Successful exploitation of CVE-2024-49375 allows an attacker to execute arbitrary code on the Rasa server with the privileges of the Rasa process. This could lead to complete system compromise, data exfiltration, or denial of service. The prerequisites for exploitation are the enabling of the HTTP API (using --enable-api) and, in the unauthenticated case, a lack of security controls. Authentication is required for authenticated RCE, necessitating a valid authentication token.

Organizations deploying Rasa for conversational AI applications are at risk, particularly those with the HTTP API enabled and lacking proper authentication. Shared hosting environments where multiple Rasa instances share resources are also at increased risk, as a compromise of one instance could potentially lead to compromise of others.

• python / server:

import subprocess
result = subprocess.run(['rasa', '--version'], capture_output=True, text=True)
if result.stdout.startswith('Rasa==3.6'):
    print('Vulnerable version detected!')

• python / server: Check for the --enable-api flag in Rasa startup scripts or configuration files. • generic web: Monitor access logs for unusual POST requests to the /webhooks/rest/webhook endpoint. • generic web: Check Rasa server configuration for authentication settings and ensure they are properly configured.

1. 2025-01-14Disclosure

   disclosure

1. Reserviert2024-10-14
2. Veröffentlicht2025-01-14
3. Geändert2025-01-15
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-49375 is to upgrade Rasa to version 3.6.21 or later. If upgrading is not immediately feasible, disable the HTTP API by not using the --enable-api flag during Rasa server startup. Implement robust authentication and authorization mechanisms to restrict access to the API. Monitor Rasa server logs for suspicious activity, particularly related to model loading and API requests. Consider using a Web Application Firewall (WAF) to filter malicious requests.