Attack Chain

1. Attacker crafts a malicious Python class with a __reduce__ method to execute arbitrary commands.
2. The malicious class is serialized into a pickle file using pickle.dumps.
3. The attacker delivers the malicious pickle file (e.g., attack_algo.pkl) to the target system. Delivery method is not specified in the source.
4. The vulnerable algo_from_pickle function is called with the path to the malicious pickle file as an argument.
5. algo_from_pickle opens the pickle file in read-binary mode ("rb").
6. The contents of the pickle file are read into the data_bytes variable.
7. pickle.loads(data_bytes) is executed, deserializing the malicious pickle data.
8. Due to the crafted __reduce__ method within the malicious class, arbitrary code execution occurs, such as launching calc.exe.

Impact

Successful exploitation of this vulnerability enables arbitrary code execution on the target system. This can lead to a complete compromise of the system, including data theft, modification, or destruction. The reported proof-of-concept uses calc.exe. This vulnerability affects MONAI versions 1.5.1 and earlier.

Recommendation

• Implement file integrity monitoring on MONAI installations to detect unauthorized modifications to the monai/auto3dseg/utils.py file.
• Deploy the Sigma rule Detect Suspicious Pickle Deserialization in MONAI to detect exploitation attempts.
• Upgrade to a patched version of MONAI that addresses the insecure deserialization vulnerability; versions later than 1.5.1 are not vulnerable.
• Implement input validation and sanitization for any file paths passed to the algo_from_pickle function to prevent the processing of untrusted files.