Summary
MONAI contains a code injection vulnerability in ConfigWorkflow.__init__ because bundle-controlled logging configuration is processed through an API that evaluates handler classes and arguments. An attacker who publishes a malicious bundle may achieve arbitrary Python code execution when a victim loads or runs that bundle.
MONAI contains a code injection vulnerability in ConfigWorkflow.__init__ because bundle-controlled logging configuration is processed through an API that evaluates handler classes and arguments. An attacker who publishes a malicious bundle may achieve arbitrary Python code execution when a victim loads or runs that bundle.
Affected context
The vulnerability occurs in MONAI workflows that load a bundle containing a configs/logging.conf file and construct a ConfigWorkflow from that bundle. Risk is present when the logging configuration is treated as trusted and passed to logging.config.fileConfig, allowing attacker-controlled handler class or argument fields to be evaluated during workflow construction.
The vulnerability occurs in MONAI workflows that load a bundle containing a configs/logging.conf file and construct a ConfigWorkflow from that bundle. Risk is present when the logging configuration is treated as trusted and passed to logging.config.fileConfig, allowing attacker-controlled handler class or argument fields to be evaluated during workflow construction.
Exploit preconditions
- Attack surface: MONAI bundle loading and workflow construction
- Required access: The attacker must be able to publish or distribute a malicious bundle that a victim can access
- Victim action: A user, service, or pipeline must load or run the bundle
- Trigger point: Processing
configs/logging.confthroughlogging.config.fileConfig - Why exploitation is possible: Handler class and argument fields can cause attacker-controlled Python expressions to be evaluated before the bundle is considered trustworthy
- Attack surface: MONAI bundle loading and workflow construction
- Required access: The attacker must be able to publish or distribute a malicious bundle that a victim can access
- Victim action: A user, service, or pipeline must load or run the bundle
- Trigger point: Processing
configs/logging.confthroughlogging.config.fileConfig - Why exploitation is possible: Handler class and argument fields can cause attacker-controlled Python expressions to be evaluated before the bundle is considered trustworthy
Why this happens
The underlying bug is the use of a configuration mechanism that evaluates values from an untrusted logging configuration as Python expressions. This allows bundle-provided handler classes and arguments to cross the boundary from data into executable behavior. The pattern maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced configuration can inject and execute code during workflow initialization.
The underlying bug is the use of a configuration mechanism that evaluates values from an untrusted logging configuration as Python expressions. This allows bundle-provided handler classes and arguments to cross the boundary from data into executable behavior. The pattern maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced configuration can inject and execute code during workflow initialization.
Potential impact
- Arbitrary Python code execution in the MONAI process
- Access to files, credentials, and environment data available to the process
- Modification or deletion of application or medical-imaging data
- Compromise of downstream jobs, services, or build environments
- Supply-chain impact affecting users who consume the malicious bundle
- Arbitrary Python code execution in the MONAI process
- Access to files, credentials, and environment data available to the process
- Modification or deletion of application or medical-imaging data
- Compromise of downstream jobs, services, or build environments
- Supply-chain impact affecting users who consume the malicious bundle
General mitigation guidance
Mitigation generally focuses on preventing untrusted bundle configuration from reaching evaluative logging APIs.
Common defensive patterns include:
- Use logging configuration formats and parsers that do not evaluate arbitrary Python expressions
- Permit only fixed, explicitly registered handler classes and validated argument types
- Treat bundles from external or unverified publishers as untrusted inputs
- Apply schema validation and allowlisting before constructing workflows
- Run bundle processing with least-privilege identities, restricted filesystem access, and limited network permissions
- Separate bundle inspection from execution and require trust or review before runtime use
Mitigation generally focuses on preventing untrusted bundle configuration from reaching evaluative logging APIs.
Common defensive patterns include:
- Use logging configuration formats and parsers that do not evaluate arbitrary Python expressions
- Permit only fixed, explicitly registered handler classes and validated argument types
- Treat bundles from external or unverified publishers as untrusted inputs
- Apply schema validation and allowlisting before constructing workflows
- Run bundle processing with least-privilege identities, restricted filesystem access, and limited network permissions
- Separate bundle inspection from execution and require trust or review before runtime use
How teams detect issues like this
Organizations can look for:
- Static analysis rules identifying
fileConfigor similar configuration APIs used with bundle-controlled paths - Code review findings where logging handler classes or arguments originate from external configuration
- Tests that load representative untrusted bundles and verify that configuration values are not evaluated
- Dependency and bundle policy checks that restrict accepted publishers, signatures, and configuration schemas
- Runtime monitoring for unexpected child processes, filesystem changes, network connections, or sensitive data access during workflow construction
Automated code review and software composition analysis tools may help identify unsafe configuration-to-code flows.
Organizations can look for:
- Static analysis rules identifying
fileConfigor similar configuration APIs used with bundle-controlled paths - Code review findings where logging handler classes or arguments originate from external configuration
- Tests that load representative untrusted bundles and verify that configuration values are not evaluated
- Dependency and bundle policy checks that restrict accepted publishers, signatures, and configuration schemas
- Runtime monitoring for unexpected child processes, filesystem changes, network connections, or sensitive data access during workflow construction
Automated code review and software composition analysis tools may help identify unsafe configuration-to-code flows.
