BentoML 1.3.9 (open redirect in the serving UI): A crafted URL against the BentoML server bounces the visitor to an

Impact

A crafted URL against the BentoML server bounces the visitor to an attacker-chosen site while the link still looks like it points at your model endpoint. Useful for credential phishing against the people who operate or consume the endpoint. No CVE was assigned to the BentoML advisory; the underlying Gradio issue is CVE-2024-4940.

Who can reach it

A remote unauthenticated attacker who gets a user to click a link pointing at the BentoML host.

What to do

Upgrade BentoML past 1.3.9 and restart the serving pods. If you cannot upgrade, block off-host redirect targets at the ingress in front of the endpoint.

References