Summary
BentoML contains a Dockerfile instruction injection vulnerability in its legacy container build template. If an attacker can supply a crafted Bento configuration or imported Bento archive, newline characters in mapping keys may cause unintended Docker build instructions to be generated and executed.
BentoML contains a Dockerfile instruction injection vulnerability in its legacy container build template. If an attacker can supply a crafted Bento configuration or imported Bento archive, newline characters in mapping keys may cause unintended Docker build instructions to be generated and executed.
Affected context
The issue occurs in BentoML containerization workflows that use the legacy base.j2 template to render Dockerfiles. Risk is higher when untrusted or insufficiently validated bentofile.yaml files or imported Bento archives can influence docker.env mapping keys during image generation.
The issue occurs in BentoML containerization workflows that use the legacy base.j2 template to render Dockerfiles. Risk is higher when untrusted or insufficiently validated bentofile.yaml files or imported Bento archives can influence docker.env mapping keys during image generation.
Exploit preconditions
- Attack surface: BentoML containerization and Dockerfile generation
- Required access: Ability to provide or cause processing of a crafted Bento configuration or archive
- Trigger point: Rendering the legacy Docker build template followed by the Docker image build
- Why exploitation is possible: Newline-containing mapping keys can cross the intended data boundary and introduce additional Dockerfile instructions
- Attack surface: BentoML containerization and Dockerfile generation
- Required access: Ability to provide or cause processing of a crafted Bento configuration or archive
- Trigger point: Rendering the legacy Docker build template followed by the Docker image build
- Why exploitation is possible: Newline-containing mapping keys can cross the intended data boundary and introduce additional Dockerfile instructions
Why this happens
The vulnerability results from treating configuration-derived mapping keys as safe Dockerfile text without sufficient encoding or structural validation. When newline characters are rendered into a Dockerfile template, attacker-controlled data can alter the generated build instructions, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The vulnerability results from treating configuration-derived mapping keys as safe Dockerfile text without sufficient encoding or structural validation. When newline characters are rendered into a Dockerfile template, attacker-controlled data can alter the generated build instructions, mapping to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- Arbitrary commands may execute in the Docker build environment
- Build-time secrets could be exposed or misused
- Generated images could be modified or poisoned
- Build infrastructure credentials or files could be compromised
- Downstream deployments may inherit malicious image content
- Arbitrary commands may execute in the Docker build environment
- Build-time secrets could be exposed or misused
- Generated images could be modified or poisoned
- Build infrastructure credentials or files could be compromised
- Downstream deployments may inherit malicious image content
General mitigation guidance
Mitigation generally focuses on preserving strict separation between configuration data and generated build instructions.
Common defensive patterns include:
- Replacing legacy template rendering with structured Dockerfile generation or safely encoded values
- Rejecting control characters and newline characters in keys and other template-bound fields
- Applying allowlists and schema validation before containerization
- Avoiding exposure of sensitive build secrets to untrusted build contexts
- Running builds with least privilege, isolated workers, and restricted network and filesystem access
- Treating imported Bento archives and build metadata as untrusted input by default
Mitigation generally focuses on preserving strict separation between configuration data and generated build instructions.
Common defensive patterns include:
- Replacing legacy template rendering with structured Dockerfile generation or safely encoded values
- Rejecting control characters and newline characters in keys and other template-bound fields
- Applying allowlists and schema validation before containerization
- Avoiding exposure of sensitive build secrets to untrusted build contexts
- Running builds with least privilege, isolated workers, and restricted network and filesystem access
- Treating imported Bento archives and build metadata as untrusted input by default
How teams detect issues like this
Detection can include static analysis for user-controlled values interpolated into Dockerfile templates, especially where keys or values are rendered without encoding. Code review should flag template expressions that can emit Dockerfile directives, missing control-character validation, and build workflows that process untrusted archives. CI policies can inspect generated Dockerfiles for unexpected instructions and restrict secret availability during builds. Automated code-review and SAST tools may help identify these patterns.
Detection can include static analysis for user-controlled values interpolated into Dockerfile templates, especially where keys or values are rendered without encoding. Code review should flag template expressions that can emit Dockerfile directives, missing control-character validation, and build workflows that process untrusted archives. CI policies can inspect generated Dockerfiles for unexpected instructions and restrict secret availability during builds. Automated code-review and SAST tools may help identify these patterns.
