Summary
MONAI's SENet model loading path can unsafely deserialize pretrained weights obtained over plaintext HTTP. An on-path attacker who can tamper with the download may substitute a crafted weights file and achieve code execution when a vulnerable SENet model is created with pretrained weights enabled.
MONAI's SENet model loading path can unsafely deserialize pretrained weights obtained over plaintext HTTP. An on-path attacker who can tamper with the download may substitute a crafted weights file and achieve code execution when a vulnerable SENet model is created with pretrained weights enabled.
Affected context
The vulnerability occurs in MONAI versions within the affected release range when SENet-based models, such as SEResNet50, are constructed with pretrained weights enabled. Risk increases when pretrained model artifacts are fetched over plaintext HTTP and the resulting .pth file is processed through a deserialization path that permits arbitrary object reconstruction.
The vulnerability occurs in MONAI versions within the affected release range when SENet-based models, such as SEResNet50, are constructed with pretrained weights enabled. Risk increases when pretrained model artifacts are fetched over plaintext HTTP and the resulting .pth file is processed through a deserialization path that permits arbitrary object reconstruction.
Exploit preconditions
- Attack surface: Network path used to retrieve pretrained model weights
- Required access: Ability to observe and tamper with the plaintext HTTP download
- Trigger point: Construction of a SENet model with pretrained weights enabled
- Why exploitation is possible: The downloaded weights are deserialized without restricting reconstructed objects, allowing attacker-controlled serialized content to execute code during loading
- Attack surface: Network path used to retrieve pretrained model weights
- Required access: Ability to observe and tamper with the plaintext HTTP download
- Trigger point: Construction of a SENet model with pretrained weights enabled
- Why exploitation is possible: The downloaded weights are deserialized without restricting reconstructed objects, allowing attacker-controlled serialized content to execute code during loading
Why this happens
The underlying flaw combines an untrusted artifact transport channel with unsafe deserialization. A model-loading function retrieves a .pth file over plaintext HTTP and processes it without enforcing a restricted weights-only format, so serialized content can cause arbitrary Python object reconstruction rather than being treated solely as model parameters. This behavior maps to CWE-502: Deserialization of Untrusted Data.
The underlying flaw combines an untrusted artifact transport channel with unsafe deserialization. A model-loading function retrieves a .pth file over plaintext HTTP and processes it without enforcing a restricted weights-only format, so serialized content can cause arbitrary Python object reconstruction rather than being treated solely as model parameters. This behavior maps to CWE-502: Deserialization of Untrusted Data.
Potential impact
- An attacker may execute arbitrary code in the process loading the model
- The application or training environment could be compromised
- Sensitive datasets, credentials, or model artifacts may be exposed
- Attackers could alter model behavior or poison downstream results
- Compromise could enable lateral movement where runtime privileges are excessive
- An attacker may execute arbitrary code in the process loading the model
- The application or training environment could be compromised
- Sensitive datasets, credentials, or model artifacts may be exposed
- Attackers could alter model behavior or poison downstream results
- Compromise could enable lateral movement where runtime privileges are excessive
General mitigation guidance
Mitigation generally focuses on making model artifact retrieval authenticated and making deserialization data-only by default.
Common defensive patterns include:
- Use authenticated encrypted transport for pretrained weights rather than plaintext HTTP
- Validate artifact integrity and provenance before loading files
- Prefer restricted, weights-only loading modes that do not reconstruct arbitrary objects
- Maintain an allowlist of trusted model sources and expected artifact formats
- Treat downloaded model files as untrusted input even when hosted by an internal service
- Run model-loading processes with least privilege and isolated filesystem and network access
- Avoid automatically executing model-loading operations during startup when artifacts have not been verified
Mitigation generally focuses on making model artifact retrieval authenticated and making deserialization data-only by default.
Common defensive patterns include:
- Use authenticated encrypted transport for pretrained weights rather than plaintext HTTP
- Validate artifact integrity and provenance before loading files
- Prefer restricted, weights-only loading modes that do not reconstruct arbitrary objects
- Maintain an allowlist of trusted model sources and expected artifact formats
- Treat downloaded model files as untrusted input even when hosted by an internal service
- Run model-loading processes with least privilege and isolated filesystem and network access
- Avoid automatically executing model-loading operations during startup when artifacts have not been verified
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis searches for model-loading APIs that deserialize pickle-compatible formats without restricted loading options
- Code review checks for pretrained weights retrieved over HTTP or without integrity verification
- Dependency and configuration policies that prohibit plaintext artifact downloads
- Runtime monitoring of unexpected network responses, model-file changes, and child-process creation during model loading
- Software composition and automated security review tools that flag unsafe deserialization and unverified model supply chains
Organizations can detect this class of issue through:
- Static analysis searches for model-loading APIs that deserialize pickle-compatible formats without restricted loading options
- Code review checks for pretrained weights retrieved over HTTP or without integrity verification
- Dependency and configuration policies that prohibit plaintext artifact downloads
- Runtime monitoring of unexpected network responses, model-file changes, and child-process creation during model loading
- Software composition and automated security review tools that flag unsafe deserialization and unverified model supply chains
