CyberRota Analysis
AI-GeneratedA vulnerability exists in the MQTT+S3 Communication Backend of FedML-AI versions up to 0.9.6, specifically in the S3Storage.read_model function, which is susceptible to deserialization attacks due to improper handling of the s3_key_str argument. This weakness allows for potential remote exploitation, posing a risk to the integrity and confidentiality of the affected systems. Organizations utilizing FedML-AI should prioritize addressing this issue to mitigate the risk of unauthorized access or data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3_key_str causes deserialization. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.