Description
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ModelTC LightLLM
Default version status: unaffected
0 to ≤ 1.2.0affected
pkg:github/ModelTC/lightllmReferences
- https://github.com/ModelTC/LightLLM/issues/1610 ↗
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/visualserver/objs.py#L6-L11 ↗
- https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/visualserver/visual_only_manager.py#L138-L140 ↗
- https://github.com/ModelTC/LightLLM ↗
- https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-visual-only-rpyc-service ↗