Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Enhance Input Validation for UpdateModel and UpdateModelGroup APIs #3639

Open
rithin-pullela-aws opened this issue Mar 12, 2025 · 0 comments
Labels
bug Something isn't working untriaged

Comments

@rithin-pullela-aws
Copy link
Contributor

What is the bug?
The 2 APIs have potential vulnerability: UpdateModel and UpdateModelGroup

Currently, these APIs accept script-like variables in their request bodies without raising exceptions, which could potentially lead to security risks.

Impact: This vulnerability could potentially be exploited to inject malicious scripts, posing a risk to the system's integrity and security.

How can one reproduce the bug?
Steps to reproduce the behavior:

  • Create a model or a model group
  • Make this API Call:
PUT /_plugins/_ml/models/w2jYiJUBIo18BRbyKFkp
{
  "name": "<script>alert(1)</script>",
  "description": "<script>alert(1)</script>"
}
  • Observe a successful update.

What is the expected behavior?
Apply stricter regex matching to validate inputs

What is your host/environment?

  • OS: [e.g. iOS]
  • Version [e.g. 22]
  • Plugins

Do you have any screenshots?
If applicable, add screenshots to help explain your problem.

Do you have any additional context?
Add any other context about the problem.

@rithin-pullela-aws rithin-pullela-aws added bug Something isn't working untriaged labels Mar 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working untriaged
Projects
None yet
Development

No branches or pull requests

1 participant