docker.dockerfile_template: "../../../secret" → copied to env/docker/Dockerfile.template
conda.environment_yml: "../../../etc/hosts" → copied to env/conda/environment.yml
Multiple path formats are supported, making exploitation trivial:
Format
description
setup_script
dockerfile_template
environment_yml
Absolute paths (/etc/passwd)
Yes
Yes
Yes
Yes
Tilde expansion (~/.ssh/id_rsa)
No
Yes
Yes
Yes
Env vars ($HOME/.aws/credentials)
No
Yes
Yes
Yes
Relative traversal (../../../etc/passwd)
Yes
Yes
Yes
Yes
Proc filesystem (/proc/self/environ)
Yes
Yes
Yes
Yes
The description field uses pathlib.Path.joinpath() directly, while other fields use resolve_user_filepath() which calls os.path.expanduser() and os.path.expandvars().
The /proc/self/environ vector is particularly dangerous in CI/CD pipelines where secrets are commonly passed as environment variables (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, DATABASE_PASSWORD, etc.).
PoC
Create a minimal service:
# service.py
import bentoml
@bentoml.service
class TestService:
@bentoml.api
def predict(self, text: str) -> str:
return text
Create malicious bentofile.yaml. Multiple attack vectors are available:
Vector 1: Exfiltrate /etc/passwd via description field
Note: The description field does not support ~ or $VAR expansion. Use absolute paths or relative traversal for description. The docker.* and conda.* fields support all path formats.
Run build:
$ bentoml build
Successfully built Bento(tag="test_service:abc123").
The exfiltrated contents are embedded in the bento archive and will be included in any push, export, or containerization of the bento.
Impact
Who is impacted: Any user who runs bentoml build on an untrusted bentofile.yaml (e.g., cloned from a malicious repository).
Attack scenarios:
Supply chain attack: Malicious contributor adds path traversal to a public ML project; anyone who clones and pushes their built model has their files exfiltrated
CI/CD environment variable theft: Using file:/proc/self/environ, an attacker can exfiltrate ALL environment variables from the build process. CI/CD pipelines commonly inject secrets this way (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, DATABASE_URL, etc.), making this a single-payload method to steal all pipeline secrets.
BentoCloud exfiltration: When victims push compromised bentos to BentoCloud (bentoml push), exfiltrated files are uploaded to the cloud platform. Any user with access to the BentoCloud organization (team members, contractors, or attackers with compromised accounts) can download the bento and extract stolen credentials. This turns BentoCloud into an unwitting exfiltration channel.
Data theft: Proprietary source code, configuration files, or database credentials embedded in bentos pushed to shared registries or BentoCloud deployments