CyberRota Analysis
AI-GeneratedA critical vulnerability exists in Feast due to improper deserialization of user-defined functions (UDFs) using the 'dill' library, allowing remote attackers to execute arbitrary code on the feature server without authentication in default configurations. Additionally, authenticated attackers can exploit this flaw to gain unauthorized access to the registry server, potentially leading to cross-tenant data exposure and lateral movement within the system. Organizations utilizing Feast should prioritize immediate remediation to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization. This vulnerability can result in cross-tenant data access and lateral movement within the system.