CVE-2024-6483

Executive Summary

CVE-2024-6483 is a path traversal vulnerability in the runs/delete-batch endpoint of aimhubio/aim version 3.19.3. The endpoint fails to sanitize user-supplied run-names, allowing an attacker to delete arbitrary files or directories on the server. This can lead to denial of service or data loss. The vulnerability has a CVSS score of 5.3 (Medium) and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the aim Python package (PyPI). Users of this package should monitor for updates and consider pinning to a safe version if a patch is released. The lack of a patch increases supply chain risk for any application that depends on this library.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is medium due to the low complexity and network attack vector, but the impact is limited to integrity and availability.

Deep Dive & Mechanics

The vulnerability exists in the runs/delete-batch endpoint. This endpoint is designed to delete log or metadata files associated with specific run-names. The application constructs file paths by concatenating a base directory with the user-supplied run-name without proper validation. An attacker can inject path traversal sequences (e.g., ../) into the run-name parameter to escape the intended directory and delete arbitrary files or directories.

For example, a request like:

POST /api/runs/delete-batch
Content-Type: application/json

{"run_names": ["../../etc/passwd"]}

could delete the /etc/passwd file on a Linux system, causing denial of service or data loss.

Vulnerable vs. Patched Code

Vulnerable Code (aim 3.19.3):

@app.route('/api/runs/delete-batch', methods=['POST'])
def delete_batch():
    data = request.get_json()
    run_names = data.get('run_names', [])
    for run_name in run_names:
        file_path = os.path.join(BASE_DIR, run_name)
        if os.path.exists(file_path):
            os.remove(file_path)
    return jsonify({"status": "ok"})

Patched Code (Hypothetical):

import os
import re

@app.route('/api/runs/delete-batch', methods=['POST'])
def delete_batch():
    data = request.get_json()
    run_names = data.get('run_names', [])
    for run_name in run_names:
        # Sanitize run_name to prevent path traversal
        safe_name = re.sub(r'[^a-zA-Z0-9_-]', '', run_name)
        file_path = os.path.join(BASE_DIR, safe_name)
        # Ensure the resolved path is within BASE_DIR
        real_path = os.path.realpath(file_path)
        if not real_path.startswith(os.path.realpath(BASE_DIR)):
            continue
        if os.path.exists(real_path):
            os.remove(real_path)
    return jsonify({"status": "ok"})

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable instance of aimhubio/aim version 3.19.3 in a controlled environment.
2. Exploit: Send a POST request to the /api/runs/delete-batch endpoint with a malicious run-name containing path traversal sequences.

   curl -X POST http://target:5000/api/runs/delete-batch \
   -H "Content-Type: application/json" \
   -d '{"run_names": ["../../etc/passwd"]}'
   

3. Verification: Check if the target file (e.g., /etc/passwd) is deleted or if the application crashes.

Blue Team

1. Detection: Monitor for unusual POST requests to /api/runs/delete-batch containing path traversal patterns (e.g., ../, ..\\).
2. Prevention: Implement input validation to reject run-names containing path traversal sequences. Use a whitelist of allowed characters.
3. Mitigation: If a patch is unavailable, consider disabling the endpoint or restricting access via network controls.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/runs/delete-batch with JSON payloads containing ../ or ..\\ in the run_names array.
• File System: Unexpected deletion of files outside the application's data directory.
• Logs: Application logs showing errors related to file deletion or path resolution.

Detection Engineering

YARA Rule

rule CVE_2024_6483_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in aimhubio/aim runs/delete-batch endpoint"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-6483"
    strings:
        $json_payload = /"run_names"\s*:\s*\[.*\.\.\/.*\]/ nocase
        $path_traversal = /\.\.\// nocase
    condition:
        $json_payload or $path_traversal
}

Sigma Rule

title: CVE-2024-6483 Path Traversal in aimhubio/aim
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in aimhubio/aim runs/delete-batch endpoint
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6483
logsource:
    category: webserver
    product: aim
detection:
    selection:
        http.method: POST
        http.url: /api/runs/delete-batch
        http.body|contains: '..\/'
    condition: selection
falsepositives:
    - Legitimate use of run-names with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6483 Path Traversal in aimhubio/aim runs/delete-batch"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/runs/delete-batch"; http.request_body; content:"..\/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply the official patch when released by aimhubio. Monitor the project's GitHub repository for updates.
2. Workaround: If patching is not possible, implement a reverse proxy or web application firewall (WAF) rule to block requests containing path traversal sequences in the /api/runs/delete-batch endpoint.
3. Input Validation: Sanitize all user-supplied run-names to allow only alphanumeric characters, underscores, and hyphens.
4. Access Control: Restrict access to the vulnerable endpoint to trusted IP addresses or networks.
5. Monitoring: Enable logging and alerting for any attempts to access the /api/runs/delete-batch endpoint.

Valters IT