Summary
MONAI's nnUNetV2Runner may insecurely deserialize a pickle file whose path is read from inference metadata. If an attacker can modify inference_information.json, they may redirect processing to a malicious pickle and execute code when ensemble postprocessing runs.
MONAI's nnUNetV2Runner may insecurely deserialize a pickle file whose path is read from inference metadata. If an attacker can modify inference_information.json, they may redirect processing to a malicious pickle and execute code when ensemble postprocessing runs.
Affected context
The vulnerability occurs in MONAI deployments using the nnUNetV2Runner and its ensemble postprocessing workflow. Risk is present when inference_information.json can be modified and the referenced postprocessing_file is not restricted to an approved results directory before deserialization.
The vulnerability occurs in MONAI deployments using the nnUNetV2Runner and its ensemble postprocessing workflow. Risk is present when inference_information.json can be modified and the referenced postprocessing_file is not restricted to an approved results directory before deserialization.
Exploit preconditions
- Attack surface: The nnUNetV2Runner inference and ensemble postprocessing workflow
- Required access: Ability to modify
inference_information.jsonor otherwise control its contents - Trigger point: Execution of
predict_ensemble_postprocessing - Why exploitation is possible: The configured path may reference a pickle outside the expected results directory, and that file is deserialized as trusted data
- Attack surface: The nnUNetV2Runner inference and ensemble postprocessing workflow
- Required access: Ability to modify
inference_information.jsonor otherwise control its contents - Trigger point: Execution of
predict_ensemble_postprocessing - Why exploitation is possible: The configured path may reference a pickle outside the expected results directory, and that file is deserialized as trusted data
Why this happens
The underlying bug is an unsafe deserialization pattern combined with insufficient path confinement. A user-controlled metadata field determines which pickle file is loaded, while the deserialization process can reconstruct attacker-controlled Python objects. This maps to CWE-502: Deserialization of Untrusted Data, because data that is not independently trusted is processed using a format capable of invoking executable behavior.
The underlying bug is an unsafe deserialization pattern combined with insufficient path confinement. A user-controlled metadata field determines which pickle file is loaded, while the deserialization process can reconstruct attacker-controlled Python objects. This maps to CWE-502: Deserialization of Untrusted Data, because data that is not independently trusted is processed using a format capable of invoking executable behavior.
Potential impact
- An attacker may execute arbitrary code in the MONAI process context.
- The affected host or container could be compromised.
- Sensitive medical, research, or application data could be accessed or altered.
- Malicious code could enable persistence, lateral movement, or further supply-chain compromise.
- An attacker may execute arbitrary code in the MONAI process context.
- The affected host or container could be compromised.
- Sensitive medical, research, or application data could be accessed or altered.
- Malicious code could enable persistence, lateral movement, or further supply-chain compromise.
General mitigation guidance
Mitigation generally focuses on removing executable deserialization from untrusted data paths and enforcing strict trust boundaries for inference metadata.
Common defensive patterns include:
- Prefer non-executable, schema-constrained formats for postprocessing metadata.
- Use restricted deserialization mechanisms when object serialization is unavoidable.
- Confine referenced files to an approved directory using canonical-path validation and reject unexpected links or traversal.
- Treat inference metadata and result files as untrusted unless their integrity and origin are established.
- Apply least-privilege permissions to the inference process and isolate workloads where practical.
- Use read-only or integrity-protected metadata storage when runtime modification is not required.
Mitigation generally focuses on removing executable deserialization from untrusted data paths and enforcing strict trust boundaries for inference metadata.
Common defensive patterns include:
- Prefer non-executable, schema-constrained formats for postprocessing metadata.
- Use restricted deserialization mechanisms when object serialization is unavoidable.
- Confine referenced files to an approved directory using canonical-path validation and reject unexpected links or traversal.
- Treat inference metadata and result files as untrusted unless their integrity and origin are established.
- Apply least-privilege permissions to the inference process and isolate workloads where practical.
- Use read-only or integrity-protected metadata storage when runtime modification is not required.
How teams detect issues like this
Detection can include static analysis for pickle loading and other deserialization APIs whose inputs are derived from files or metadata fields. Code review should examine whether file paths are user-controlled, whether canonical paths are validated, and whether deserialization occurs before integrity or schema checks. Policy enforcement can require approved serialization formats, restrict executable deserialization in production code, and flag metadata-controlled filesystem access during automated review.
Detection can include static analysis for pickle loading and other deserialization APIs whose inputs are derived from files or metadata fields. Code review should examine whether file paths are user-controlled, whether canonical paths are validated, and whether deserialization occurs before integrity or schema checks. Policy enforcement can require approved serialization formats, restrict executable deserialization in production code, and flag metadata-controlled filesystem access during automated review.
