BentoML (Dockerfile template, docker.base_image interpolation): A multi-line docker.base_image value in bento.yaml

Impact

A multi-line docker.base_image value in bento.yaml smuggles arbitrary directives into the generated Dockerfile, and bentoml containerize then executes them via docker build on the machine doing the build. On a shared build node or CI runner that is code execution with the builder's credentials - registry push tokens, cloud roles, and whatever else the runner holds.

Who can reach it

Anyone who can get a victim to run bentoml containerize against an attacker-supplied bento.yaml - a pull request, a shared model repo, or a marketplace bento.

What to do

Upgrade BentoML to 1.4.39 or later. Run bentoml build and containerize for untrusted bentos in a throwaway sandbox with no registry or cloud credentials mounted, since this is one of a series of Dockerfile-template injection bugs in the same code path.

References