Feast Deserialization Flaw Leads to Code Execution

Executive Summary

This vulnerability in Feast involves improper deserialization of user-defined functions (UDFs) stored in its registry. These UDFs are serialized using the 'dill' library, which allows a remote attacker to store a malicious UDF. This leads to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also bypass authorization checks during deserialization to achieve arbitrary code execution on the registry server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on affected systems. For users of Feast, this could result in unauthorized access to sensitive data, potential data breaches, and lateral movement within the system. Cross-tenant data access is also possible, meaning attackers could access data from other tenants in a multi-tenant environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Unauthorized access to sensitive data could result in legal penalties, reputational damage, and loss of trust. Organizations using Feast must address this issue to maintain compliance with data protection standards.

Useful 0 Not Useful 0

Mitigation Strategies

Disable or restrict access to the Feast feature server and registry server until patches are applied. Ensure network segmentation prevents unauthorized access to these components. Review and remove any untrusted user-defined functions (UDFs) from the registry. Monitor for suspicious activity related to deserialization or code execution.

Useful 0 Not Useful 0