CVE-2023-43654 in the critical feed json
TorchServe Server-Side Request Forgery
published 2023-09-28 3 y ago modified 2026-09-10 1 mo ago also GHSA-8fxr-qfr9-p34w , PYSEC-2026-553 , EUVD-2023-2697
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 42.5%
- EPSS 42.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- pypi torchserve 0.8.2
- pytorch torchserve 0.8.2
- github.com/pytorch/serve#2534 pull request
- github.com/pytorch/serve/releases/tag/v0.8.2 release
Timeline
- Published
- First public exploit (Metasploit exploit/multi/http/torchserver_cve_2023_43654)
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
42.49% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/torchserver_cve_2023_43654 PyTorch Model Server Registration and Deserialization RCE metasploit exploit, excellent rank, 2023-10-03
- Nuclei template PyTorch TorchServe SSRF nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | torchserve | >=0.1.0, <0.8.2 |
0.8.2 |
Affected products
- pytorch serve
- pytorch torchserve
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/pytorch/serve/pull/2534
web, issue-tracking
-
packetstormsecurity.com
/files/175095/PyTorch-Model-Server-Registration-Deserialization-Remote-Code-Execution.html
web, exploit, third-party-advisory, vdb-entry
-
github.com
/pytorch/serve/security/advisories/GHSA-8fxr-qfr9-p34w
web, vendor-advisory
-
github.com
/pytorch/serve/releases/tag/v0.8.2
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-43654
advisory
-
github.com
/pytorch/serve
package
-
pypi.org
/project/torchserve
package
-
github.com
/advisories/GHSA-8fxr-qfr9-p34w
advisory
Sources
- CVE List CVE-2023-43654
- GitHub Advisory GHSA-8fxr-qfr9-p34w
- NVD CVE-2023-43654
- OSV PYSEC-2026-553
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.