CVE-2024-32023

Executive Summary

CVE-2024-32023 is a path injection vulnerability in Kohya_ss, a GUI for Kohya's Stable Diffusion trainers. The flaw resides in the common_gui.py find_and_replace function, allowing an attacker to manipulate file paths and potentially read or write arbitrary files on the system. With a CVSS score of 6.5 (Medium), this vulnerability requires no authentication and can be exploited over a network. The vendor has released a fix in version 23.1.5, but no public exploit code or proof-of-concept is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

Kohya_ss is a Python-based application distributed via GitHub and PyPI. The vulnerability affects the core GUI component, which is part of the standard distribution. Users who install via pip install kohya_ss or clone the repository are affected if they are running a version prior to 23.1.5. The supply chain risk is moderate, as the vulnerability is in the application logic rather than a dependency, but any compromised dependencies could exacerbate the issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited file read access.
• Integrity Impact: Low (I:L) – Limited file write/modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability allows path traversal, which can lead to unauthorized file access or modification. While not critical, it can be chained with other vulnerabilities for greater impact.

Deep Dive & Mechanics

The vulnerability exists in the find_and_replace function within common_gui.py. This function is used to process user-supplied paths for file operations, such as loading or saving configuration files. The lack of proper input validation allows an attacker to inject path traversal sequences (e.g., ../) to escape the intended directory.

Root Cause: The function does not sanitize or canonicalize user-provided paths before passing them to file system operations. This enables an attacker to specify arbitrary file paths, leading to unauthorized read or write access.

Attack Vector: An attacker can send a crafted HTTP request to the Kohya_ss web interface, manipulating the path parameter in the find_and_replace function. For example:

POST /api/find_and_replace HTTP/1.1
Host: target:7860
Content-Type: application/json

{"path": "../../etc/passwd", "find": "root", "replace": "attacker"}

This could allow reading sensitive files or overwriting critical system files.

Impact: Successful exploitation could lead to:

• Reading sensitive files (e.g., /etc/passwd, configuration files).
• Writing malicious files to arbitrary locations, potentially leading to remote code execution if combined with other vulnerabilities.

Vulnerable vs. Patched Code

Vulnerable Code (pre-23.1.5):

def find_and_replace(path, find, replace):
    with open(path, 'r') as f:
        content = f.read()
    content = content.replace(find, replace)
    with open(path, 'w') as f:
        f.write(content)

The path parameter is used directly without validation.

Patched Code (23.1.5):

import os

def find_and_replace(path, find, replace):
    safe_path = os.path.realpath(path)
    allowed_dir = os.path.realpath('/allowed/base/directory')
    if not safe_path.startswith(allowed_dir):
        raise ValueError("Path traversal detected")
    with open(safe_path, 'r') as f:
        content = f.read()
    content = content.replace(find, replace)
    with open(safe_path, 'w') as f:
        f.write(content)

The patch uses os.path.realpath() to resolve the path and checks that it starts with an allowed base directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Kohya_ss version < 23.1.5 running on a target.
• Network access to the web interface (default port 7860).

Exploitation Steps:

1. Identify the target Kohya_ss instance.
2. Send a crafted POST request to the /api/find_and_replace endpoint.
3. Use path traversal to read sensitive files.

Example Request:

curl -X POST http://target:7860/api/find_and_replace \
  -H "Content-Type: application/json" \
  -d '{"path": "../../etc/passwd", "find": "root", "replace": "attacker"}'

Expected Output: The file /etc/passwd will be modified, replacing "root" with "attacker". For read-only access, use a non-existent find string to trigger an error that reveals file content.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defense)

Detection:

• Monitor for unusual HTTP requests to /api/find_and_replace with path traversal patterns (e.g., ../).
• Use web application firewalls (WAF) to block requests containing ../ in JSON parameters.
• Enable logging of file access operations in Kohya_ss.

Hunting:

• Search logs for find_and_replace calls with suspicious paths.
• Check for unexpected file modifications in sensitive directories.

Mitigation:

• Immediately upgrade to Kohya_ss 23.1.5 or later.
• If upgrade is not possible, restrict network access to the web interface.
• Implement input validation at the reverse proxy level.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/find_and_replace with ../ in the path parameter.
  • Unusual outbound connections from the Kohya_ss server.
• File System:
  • Unexpected modifications to files outside the application directory.
  • Presence of new files in /tmp or /etc with suspicious content.
• Logs:
  • Error messages indicating path traversal attempts.
  • find_and_replace function calls with non-standard paths.

Detection Engineering

YARA Rule

rule CVE_2024_32023_Path_Injection {
    meta:
        description = "Detects path injection attempts in Kohya_ss find_and_replace function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-32023"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $api_endpoint = "/api/find_and_replace"
    condition:
        $api_endpoint and $path_traversal
}

Sigma Rule

title: CVE-2024-32023 Path Injection in Kohya_ss
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Kohya_ss find_and_replace API
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/api/find_and_replace'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32023 Kohya_ss Path Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/find_and_replace"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Kohya_ss to version 23.1.5 or later.
2. If upgrade is not possible, restrict access to the web interface using firewall rules or VPN.
3. Implement a WAF rule to block requests containing ../ in JSON payloads.

Long-Term Measures:

• Conduct a code review of all file handling functions in Kohya_ss.
• Implement input validation and canonicalization for all user-supplied paths.
• Use a security linter to detect path traversal vulnerabilities in Python code.
• Monitor for similar CVEs in the Kohya_ss ecosystem.

Patch Verification:

• After upgrading, verify the fix by checking the common_gui.py file for the os.path.realpath() usage.
• Test the application with a path traversal payload to ensure it is blocked.

Valters IT
Securing Digital Frontiers