Remote Code Execution in MONAI Bundle Configuration Engine

MONAI (Medical Open Network for AI) versions 1.6.0 and earlier contain a critical remote code execution (RCE) vulnerability within the bundle configuration engine. The vulnerability stems from the engine's failure to maintain an allow list when resolving 'target' values to importable callables, combined with the unsafe passing of '$' expressions to the Python 'eval()' function.

An attacker can exploit this by crafting a malicious bundle configuration file and distributing it to unsuspecting users. When a victim loads or executes this bundle using the affected 'monai.bundle.load()' or 'monai.bundle.run()' functions, the engine processes the malicious configuration, resulting in arbitrary code execution on the host system. This vulnerability poses a significant risk to researchers and developers who frequently download and integrate third-party AI bundles, as the malicious code triggers immediately upon processing the configuration.

Impact

Successful exploitation allows for arbitrary code execution in the context of the Python interpreter running the MONAI environment. This could lead to full system compromise, exfiltration of sensitive medical imaging data, or lateral movement within research and development networks.

Recommendation

• Immediately update MONAI to a version beyond 1.6.0.
• Avoid loading MONAI bundles from untrusted sources or repositories.
• Inspect bundle configuration files ('bundle.json' or similar) for unexpected 'target' definitions or embedded '$' expressions before execution.
• Implement monitoring for child processes spawned by Python interpreter instances running MONAI-related tasks.