CVE-2024-10110

Executive Summary

CVE-2024-10110 is a denial-of-service (DoS) vulnerability in aimhubio/aim version 3.23.0. The ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, causing the main thread to block indefinitely. This prevents the server from processing any other requests, leading to a complete service outage. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. No public exploit code or proof-of-concept is available, but the attack vector is network-based with low complexity.

Supply Chain & Package Security

This vulnerability affects the Python package aim (PyPI). Users of this package in their software supply chain are at risk. The package is used for AI/ML experiment tracking, and a DoS on the tracking server can disrupt development workflows and CI/CD pipelines. No malicious package versions have been reported, but the lack of a patch increases supply chain risk.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Complete denial of service.

Threat Level: High. The vulnerability is easy to exploit remotely without authentication, leading to a complete service outage. The lack of a patch makes all instances of aim 3.23.0 vulnerable.

Deep Dive & Mechanics

The vulnerability lies in the ScheduledStatusReporter class within the aim tracking server. In version 3.23.0, this object can be instantiated to run on the main thread. The ScheduledStatusReporter is designed to periodically report status, but when it runs on the main thread, it enters an infinite loop or a blocking state that never releases the thread. This prevents the main event loop from handling any incoming HTTP requests or other tasks.

The root cause is improper thread management: the object should be run on a separate thread or as a background task, but the code allows it to be started on the main thread without any safeguards. An attacker can trigger this by sending a specially crafted request that causes the server to instantiate the ScheduledStatusReporter on the main thread. Once blocked, the server becomes unresponsive until manually restarted.

Vulnerable vs. Patched Code

Vulnerable Code (aim 3.23.0):

class ScheduledStatusReporter:
    def __init__(self, server):
        self.server = server
        self.running = True

    def start(self):
        # Runs on the main thread, blocking indefinitely
        while self.running:
            self.report_status()
            time.sleep(60)

    def report_status(self):
        # Simulate status reporting
        pass

Patched Code (Hypothetical Fix):

import threading

class ScheduledStatusReporter:
    def __init__(self, server):
        self.server = server
        self.running = True
        self.thread = threading.Thread(target=self._run)

    def start(self):
        # Runs on a separate thread to avoid blocking the main thread
        self.thread.start()

    def _run(self):
        while self.running:
            self.report_status()
            time.sleep(60)

    def report_status(self):
        # Simulate status reporting
        pass

The fix involves running the ScheduledStatusReporter on a separate thread, allowing the main thread to continue processing requests.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on the aim tracking server.

Prerequisites:

• Target running aim 3.23.0 with default configuration.
• Network access to the tracking server (default port 43800).

Exploitation Steps:

1. Identify the target IP and port (e.g., 192.168.1.100:43800).
2. Send a crafted HTTP request that triggers the ScheduledStatusReporter instantiation on the main thread. The exact request depends on the API endpoint; for example, if the server exposes a /status endpoint that starts the reporter:

   curl -X POST http://192.168.1.100:43800/status -d '{"action":"start"}'
   

3. The server will become unresponsive. Verify by attempting to access any other endpoint:

   curl http://192.168.1.100:43800/health
   

   This request will hang indefinitely.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for sudden unresponsiveness of the aim tracking server.
• Check server logs for repeated ScheduledStatusReporter start attempts.
• Use network monitoring to detect anomalous requests to the /status endpoint.

Mitigation:

• Restrict network access to the tracking server using firewalls.
• Implement rate limiting on API endpoints.
• Monitor thread usage and set alerts for main thread blocking.

Lab Setup:

1. Install aim 3.23.0 in a controlled environment:

   pip install aim==3.23.0
   

2. Start the tracking server:

   aim up
   

3. Simulate the attack by sending the crafted request (if known) or by modifying the source code to trigger the vulnerability.

Indicators of Compromise (IOCs)

• Network: Repeated POST requests to /status or similar endpoints.
• Logs: Entries indicating ScheduledStatusReporter started on main thread.
• System: The aim process becomes unresponsive, consuming 100% CPU on the main thread.
• File: No file-based IOCs; the vulnerability is purely in-memory.

Detection Engineering

YARA Rule

rule CVE_2024_10110_Aim_DoS {
    meta:
        description = "Detects aim 3.23.0 source code with vulnerable ScheduledStatusReporter"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $vuln_code = "while self.running:" ascii wide
        $class_name = "ScheduledStatusReporter" ascii wide
    condition:
        $class_name and $vuln_code
}

Sigma Rule

title: CVE-2024-10110 - Aim Tracking Server DoS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects potential exploitation of CVE-2024-10110 by monitoring for repeated requests to the /status endpoint.
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: aim
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/status'
        cs-uri-query: '*action=start*'
    condition: selection
falsepositives:
    - Legitimate status reporting requests
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10110 - Aim Tracking Server DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"/status"; http_uri; content:"action=start"; http_client_body; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate vulnerable instances: Restrict network access to the aim tracking server using firewalls or VPNs.
2. Monitor for exploitation: Use the provided detection rules to identify attacks.
3. Apply workaround: If possible, modify the source code to run ScheduledStatusReporter on a separate thread (see patched code example).

Long-term Fix:

• Wait for the vendor to release a patched version. Until then, consider downgrading to a previous stable version (e.g., 3.22.0) if available.
• Implement a reverse proxy with rate limiting and request filtering.

Vendor Contact:

• No official patch has been released. Monitor the aimhubio GitHub repository for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert