RCE via Unsafe Deserialization in invoke-ai/invokeai /api/v2/models/install

This repository is a small, focused exploit kit for testing and exploiting unsafe deserialization in InvokeAI, explicitly referencing CVE-2024-12029. It contains two Python scripts and a README. The main purpose is to generate malicious pickle-based checkpoint files and then deliver them to the InvokeAI model installation API to confirm remote code execution or obtain shell access. Repository structure: README.md documents the attack flow, expected payload files, and manual usage examples. reverse_shell_payload.py is the payload generator; it defines multiple Python classes whose __reduce__ methods return os.system invocations so that arbitrary commands execute when the object is deserialized. It generates four .ckpt payloads: bash reverse shell, Python reverse shell, netcat reverse shell, and HTTP callback test. kali_reverse_test.py is an operator helper script that sends POST requests to the target InvokeAI endpoint /api/v2/models/install with a source parameter pointing to attacker-hosted payload files, and optionally starts a local netcat listener. Exploit capabilities: (1) verify deserialization/RCE via HTTP callback to attacker web server, (2) gain interactive shell access via reverse shell over TCP/4444 using bash, Python, or netcat, and (3) verify basic command execution by creating a marker file on the target. The exploit is operational rather than a mere PoC because it includes working payload generation and delivery logic, but payload customization is basic and hardcoded around specific IPs and ports. Notable endpoints and targets: the target API is hardcoded as http://192.168.117.218:9090/api/v2/models/install. Attacker infrastructure is hardcoded as 192.168.45.168, serving payloads over HTTP on port 8000 and receiving reverse shells on TCP/4444. The code also references /tmp/payload_test.txt as a local artifact on the victim for execution verification. Overall, this is a genuine exploit repository centered on web-triggered unsafe deserialization leading to OS command execution and reverse shell establishment.

This repository contains a single Metasploit module targeting CVE-2024-12029, a critical remote code execution vulnerability in InvokeAI (versions 4.0.0 to 5.4.2) on Linux. The exploit abuses the /api/v2/models/install API endpoint, which unsafely deserializes user-supplied model files using torch.load, allowing attackers to execute arbitrary code by supplying a malicious model file. The module checks the target's version via /api/v1/app/version, then serves a malicious model file via an embedded HTTP server, and finally triggers the vulnerable endpoint to load the file, resulting in code execution. The payload is customizable and leverages Python deserialization to execute arbitrary commands. The exploit is weaponized, as it is part of the Metasploit framework and supports flexible payload delivery. The only file present is a Ruby Metasploit module, and the main attack vector is network-based, targeting HTTP endpoints exposed by InvokeAI.