Remote Code Execution in ZenML CloudpickleMaterializer

Executive Summary

ZenML 0.94.6 has a remote code execution vulnerability in the CloudpickleMaterializer component. Attackers with write access to a shared artifact store can execute arbitrary code by replacing a legitimate artifact.pkl file with a malicious cloudpickle payload containing a crafted __reduce__ method. When the artifact is materialized, the unsanitized cloudpickle.load() call in cloudpickle_materializer.py executes the malicious payload, triggering arbitrary system commands.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect artifact.pkl files in your ZenML shared artifact store for unexpected content or modifications. Check for files with unusual sizes or timestamps. Use commands like 'find /artifact/store -name "*.pkl" -exec ls -la {} \;' to list pickle files and their metadata. Verify file hashes against expected values if hash validation is enabled.

Useful 0 Not Useful 0

Impact Analysis

If you use ZenML 0.94.6 with a shared artifact store, an attacker with write access could replace stored artifacts with malicious files. When you or your pipelines load these artifacts, arbitrary code may execute on your system, potentially leading to data breaches, system compromise, or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using ZenML 0.94.6 may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update ZenML to a patched version that includes content hash validation for cloudpickle artifacts. If updating is not possible, restrict write access to the shared artifact store to trusted users only. Monitor artifact.pkl files for unauthorized changes and implement additional validation checks before loading artifacts.

Useful 0 Not Useful 0