CVE-2024-37306

Executive Summary

CVE-2024-37306 is a Cross-Site Request Forgery (CSRF) vulnerability in the Computer Vision Annotation Tool (CVAT), an open-source interactive video and image annotation platform. An attacker can trick an authenticated CVAT user into visiting a malicious URL, which then silently triggers a dataset export or backup from a project, task, or job that the victim has permission to export. The exported data is written to a cloud storage bucket that the victim has access to, with a filename chosen by the attacker. This allows the attacker to overwrite arbitrary files in the victim's cloud storage and, if the attacker also has read access to that storage, exfiltrate sensitive media files, annotations, and project settings. The vulnerability affects CVAT versions 2.2.0 through 2.14.2. The fix is included in version 2.14.3.

Supply Chain & Package Security

CVAT is a Python/Django application distributed via Docker images and PyPI. The vulnerability is in the application logic, not in a dependency. However, organizations using CVAT should verify the integrity of their deployment images and ensure they are running the patched version (2.14.3 or later). No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a malicious link.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Sensitive data (annotations, media files) can be exfiltrated.
• Integrity (I): High – Attacker can overwrite arbitrary files in cloud storage.
• Availability (A): None – No direct impact on availability.

Threat Level: High. The attack requires user interaction, but the potential for data exfiltration and file overwrite in cloud storage makes this a serious risk for organizations using CVAT with cloud storage integrations.

Deep Dive & Mechanics

The vulnerability lies in the lack of CSRF protection on endpoints that trigger dataset exports and backups. CVAT uses Django, which provides built-in CSRF protection for state-changing requests (POST, PUT, DELETE). However, the export/backup functionality was likely implemented using GET requests or without proper CSRF token validation, allowing an attacker to craft a malicious URL that, when visited by an authenticated user, performs the export action on their behalf.

Attack Flow:

1. The attacker identifies a CVAT instance (e.g., https://cvat.example.com).
2. The attacker crafts a URL that triggers an export of a specific project, task, or job. For example: https://cvat.example.com/api/v1/projects/123/export?target=cloud_storage&cloud_storage_id=456&filename=malicious_file.zip
3. The attacker sends this URL to a logged-in CVAT user (e.g., via email, social media, or a compromised website).
4. The victim clicks the link while authenticated to CVAT.
5. The victim's browser sends a request to the CVAT server, which processes the export without verifying the request's origin (no CSRF token).
6. The CVAT server exports the data to the specified cloud storage bucket (e.g., S3, GCS) with the attacker-controlled filename.
7. If the attacker has read access to that cloud storage bucket, they can download the exported data.

Key Weakness: The export/backup endpoints do not enforce CSRF tokens, allowing cross-origin requests to be processed as if they were legitimate.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.14.3):

# views.py (simplified)
@login_required
def export_project(request, project_id):
    # No CSRF check
    cloud_storage_id = request.GET.get('cloud_storage_id')
    filename = request.GET.get('filename', 'export.zip')
    # ... export logic ...
    return JsonResponse({'status': 'ok'})

Patched Code (2.14.3):

# views.py (simplified)
from django.views.decorators.csrf import csrf_protect

@login_required
@csrf_protect
def export_project(request, project_id):
    if request.method == 'POST':
        cloud_storage_id = request.POST.get('cloud_storage_id')
        filename = request.POST.get('filename', 'export.zip')
        # ... export logic ...
        return JsonResponse({'status': 'ok'})
    else:
        return JsonResponse({'error': 'Method not allowed'}, status=405)

The patch adds @csrf_protect decorator and restricts the endpoint to POST requests only, preventing CSRF attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running CVAT instance (version 2.2.0 to 2.14.2) with at least one user logged in.
• A cloud storage bucket (e.g., AWS S3) that the victim user has configured in CVAT.
• Knowledge of the victim's project/task/job ID and cloud storage ID.

Exploit Steps:

1. Identify the victim's CVAT instance and obtain a valid project ID (e.g., 123) and cloud storage ID (e.g., 456).
2. Craft the malicious URL:

   https://cvat.example.com/api/v1/projects/123/export?cloud_storage_id=456&filename=exfiltrated_data.zip
   

3. Send this URL to the victim (e.g., via a phishing email).
4. Once the victim clicks the link, the export is triggered, and the data is written to the cloud storage bucket.
5. If you have read access to the bucket, download the file.

Note: No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor CVAT access logs for GET requests to /api/v1/*/export or /api/v1/*/backup endpoints.
• Alert on requests to these endpoints that do not originate from the CVAT web interface (e.g., missing Referer header).
• Monitor cloud storage buckets for unexpected file uploads, especially with unusual filenames or from CVAT IPs.

Prevention:

• Upgrade to CVAT 2.14.3 or later.
• Implement a Web Application Firewall (WAF) rule to block GET requests to export/backup endpoints.
• Enforce strict Referer header validation on the CVAT server.
• Use network segmentation to restrict CVAT server access to trusted IPs only.

Indicators of Compromise (IOCs)

• Network:
  • GET requests to /api/v1/projects/*/export or /api/v1/tasks/*/export or /api/v1/jobs/*/export with cloud_storage_id and filename parameters.
  • Requests to these endpoints without a valid Referer header matching the CVAT domain.
• File System:
  • Unexpected files in cloud storage buckets with names like exfiltrated_data.zip, backup_*.zip, or attacker-chosen names.
• Logs:
  • CVAT access logs showing export requests from IPs not associated with the CVAT web interface.
  • Cloud storage access logs showing uploads from CVAT server IPs to unusual paths.

Detection Engineering

YARA Rule

rule CVE_2024_37306_CVAT_CSRF_Export {
    meta:
        description = "Detects CVAT export requests indicative of CVE-2024-37306 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-37306"
    strings:
        $export_path = /\/api\/v1\/(projects|tasks|jobs)\/\d+\/export/
        $cloud_storage_param = /cloud_storage_id=\d+/
        $filename_param = /filename=[^&]+/
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-37306 CVAT CSRF Export Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects GET requests to CVAT export endpoints without proper Referer header
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith:
            - '/api/v1/projects/'
            - '/api/v1/tasks/'
            - '/api/v1/jobs/'
        cs-uri-stem|contains: '/export'
    filter:
        cs-uri-query|contains: 'cloud_storage_id='
    condition: selection and filter
falsepositives:
    - Legitimate exports from the CVAT web interface
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37306 CVAT CSRF Export Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/v1/"; http_uri;
    content:"/export"; http_uri;
    content:"cloud_storage_id="; http_uri;
    pcre:"/\/api\/v1\/(projects|tasks|jobs)\/\d+\/export/Ui";
    sid:1000001;
    rev:1;
    metadata:created_at 2025-04-10, cve CVE-2024-37306;
)

Remediation & Mitigation

Immediate:

1. Upgrade CVAT to version 2.14.3 or later.
2. If upgrade is not possible, implement a WAF rule to block GET requests to /api/v1/*/export and /api/v1/*/backup endpoints.
3. Restrict cloud storage bucket access to only necessary CVAT users and services.

Long-term:

1. Conduct a security audit of all CVAT endpoints to ensure CSRF protection is applied.
2. Implement additional security controls such as Content Security Policy (CSP) headers and strict Referer validation.
3. Monitor for any signs of exploitation using the provided detection rules.

Workarounds: No known workarounds are available. The only fix is to upgrade to version 2.14.3.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert