Full Report
The Wiz Research team's investigations into AI-as-a-service providers reveals a major risk to AI systems.
Analysis Summary
# Vulnerability: Remote Code Execution Leading to Cross-Container Data Exposure via Malicious AI Models on Replicate Platform
## CVE Details
- CVE ID: Not explicitly assigned in the provided text.
- CVSS Score: Not explicitly provided, but the description implies **Critical** impact (unauthorized access to all customers' prompts and results).
- CWE: Potentially related to CWE-20 (Improper Input Validation) or an isolation weakness (e.g., misconfigured container runtime isolation).
## Affected Systems
- Products: Replicate AI Platform (using Cog container format).
- Versions: All versions prior to the fix implemented in January 2024.
- Configurations: Any environment where untrusted, malicious Cog containers could be uploaded and run for inference.
## Vulnerability Description
The vulnerability resides in how Replicate handles the execution of user-uploaded, containerized AI models packaged using the Cog format. A malicious Cog container, when executed, allowed an attacker to achieve Remote Code Execution (RCE) as the `root` user within their dedicated container.
Crucially, due to the Kubernetes networking configuration, the victim container shared its network namespace with another container inside the same pod. Leveraging this shared network, the attacker could inspect plaintext TCP traffic, specifically identifying an established connection to an internal Redis instance used for queuing. The attacker, possessing `CAP_NET_RAW` and `CAP_NET_ADMIN` capabilities, could then snoop on this plaintext Redis traffic, potentially gaining unauthorized access to customer prompts and results queued on that instance across tenants.
## Exploitation
- Status: **PoC available** (Demonstrated by Wiz Research).
- Complexity: **Medium** (Requires knowledge of container runtime internals, Kubernetes shared networking, and model packaging formats like Cog).
- Attack Vector: **Network** (Initial trigger via HTTP inference request, followed by network inspection within the shared pod).
## Impact
- Confidentiality: **High** (Access to prompts and results of all platform customers).
- Integrity: **Medium/High** (Potential to manipulate queued jobs, depending on Redis configuration).
- Availability: **Low/Medium** (Impact limited primarily to confidentiality exposure, though resource abuse is possible).
## Remediation
### Patches
- Replicate promptly investigated and addressed the issue following responsible disclosure in January 2024. Specific patch versions are not listed, but the vulnerability has been mitigated by Replicate.
### Workarounds
- No customer action is required as the issue has been fixed by the vendor.
## Detection
- **Indicators of Compromise:** Look for unusual network activity originating from inference containers that attempt to inspect processes in different PID namespaces or scan established TCP connections (e.g., using `netstat`, `tcpdump`) destined for internal infrastructure services like Redis.
- **Detection Methods and Tools:** Enhanced runtime security monitoring (e.g., Falco, eBPF tools) configured to flag execution of privileged network tools (`tcpdump`, `netstat`) inside inference containers, or unauthorized attempts to access shared network resources within Kubernetes pods.
## References
- Wiz Research (Wiz and Hugging Face installment): hxxps://www.wiz.io/blog/wiz-and-hugging-face-address-risks-to-ai-infrastructure
- Wiz Research (Replicate installment): [Not explicitly provided as a distinct link, but implied in the main text]
- Replicate Disclosure Post: hxxps://replicate.com/blog/shared-network-vulnerability-disclosure