BentoML SSRF Vulnerability in File Upload Processing

The SSRF vulnerability in BentoML arises from insecure handling of file uploads within the serialization/deserialization process for multipart form data and JSON requests. BentoML automatically downloads files from user-provided URLs without proper validation of internal network addresses. This allows an attacker to craft malicious requests that instruct the server to fetch data from internal services or external resources, effectively bypassing authentication and authorization controls. The potential impact includes unauthorized access to sensitive data, modification of internal configurations, and even the execution of arbitrary code on the server, depending on the targeted internal services. This vulnerability is particularly concerning given BentoML's role in deploying and serving machine learning models, which often handle sensitive data and critical business logic.

Organizations deploying machine learning models using BentoML, particularly those with internal network resources accessible to the model serving platform, are at risk. Legacy BentoML deployments and those lacking robust network segmentation are especially vulnerable.

• python / server:

import requests
import urllib.parse

def check_bentoml_ssrf(url):
    try:
        parsed_url = urllib.parse.urlparse(url)
        if parsed_url.scheme in ('http', 'https') and parsed_url.netloc:
            # Check for internal IP addresses or unusual domains
            if any(octet in parsed_url.netloc for octet in range(1, 256)):
                return True
    except Exception as e:
        print(f"Error parsing URL: {e}")
    return False

# Example usage (replace with actual BentoML endpoint)
url = "http://localhost:8000/upload?url=http://169.254.169.254/latest/meta-data/"
if check_bentoml_ssrf(url):
    print("Potential SSRF vulnerability detected!")
else:
    print("No SSRF vulnerability detected.")

• linux / server:

journalctl -u bentoml -f | grep -i "request: http" # Monitor for outbound HTTP requests

1. 2025-07-29Disclosure

   disclosure

2. 2025-07-29Patch

   patch

1. Reserviert2025-07-21
2. Veröffentlicht2025-07-29
3. Geändert2025-07-30
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-54381 is to upgrade BentoML to version 1.4.19 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting network access to BentoML instances using firewalls or network segmentation. Additionally, implement strict input validation on all file upload parameters to prevent attackers from injecting malicious URLs. Web Application Firewalls (WAFs) configured to block suspicious outbound requests can also provide a layer of defense. Monitor BentoML logs for unusual outbound HTTP requests originating from unexpected sources.