Skip to content

Commit f579235

Browse files
Apply suggestions from code review
Co-authored-by: jheysel-r7 <[email protected]>
1 parent e1b5109 commit f579235

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

modules/exploits/linux/http/bentoml_runner_server_rce_cve_2025_32375.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ def initialize(info = {})
1313
super(
1414
update_info(
1515
info,
16-
'Name' => "BentoML's runner server RCE",
16+
'Name' => 'BentoML's runner server RCE',
1717
'Description' => %q{
18-
There was an insecure deserialization in BentoML's runner server.
19-
By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server,
20-
which will grant the attackers to have the initial access and information disclosure on the server.
18+
There was an insecure deserialization in BentoML's runner server prior to version 1.4.8.
19+
By setting specific headers and parameters in the POST request, it is possible to execute unauthorized arbitrary code in the context of the user running the server,
20+
which will grant initial access and information disclosure.
2121
},
2222
'Author' => [
2323
'SeaWind', # Vulnerability discovery and PoC
@@ -62,7 +62,7 @@ def initialize(info = {})
6262
)
6363
register_options(
6464
[
65-
Opt::RPORT(3000),
65+
Opt::RPORT(3000)
6666
]
6767
)
6868
end

0 commit comments

Comments
 (0)