CVE-2023-43654 is a critical vulnerability in TorchServe versions 0.1.0 to 0.8.1, a tool for serving PyTorch models, stemming from a lack of proper input validation in its default configuration. This flaw allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) by invoking remote HTTP download requests and writing arbitrary files to the disk, potentially leading to full system compromise. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction. While not yet on the KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, and it has garnered significant community discussion and media coverage, highlighting its severe risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0.1.0, < 0.8.2CPE matchmatch criteria | cpe:2.3:a:pytorch:torchserve:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.