CVE-2024-6851

Executive Summary

CVE-2024-6851 is a high-severity arbitrary file deletion vulnerability in Aimhubio Aim version 3.22.0. The flaw resides in the LocalFileManager._cleanup function, which accepts a user-specified glob-pattern without verifying that the matched files reside within the managed directory. This allows an unauthenticated attacker to delete arbitrary files on the server, potentially leading to denial of service, data loss, or system compromise. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python package aim (PyPI). Organizations using Aim for ML experiment tracking should immediately assess their exposure. Since the package is open-source, supply chain risk includes potential malicious forks or compromised dependencies. Verify the integrity of your aim installation and monitor for any suspicious updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and affected resource are the same.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion compromises system integrity.
• Availability (A): High (H) – Deletion of critical files can cause denial of service.

CVSS Score: 7.5 (High)

Threat Level: High – The vulnerability is easily exploitable remotely with no authentication, and the impact on integrity and availability is severe.

Deep Dive & Mechanics

The vulnerability exists in the LocalFileManager._cleanup function within Aim's tracking server. This function is designed to clean up old or temporary files based on a user-supplied glob pattern. The core issue is the lack of path traversal validation.

How it works:

1. The Aim server exposes an API endpoint that allows users to trigger cleanup operations.
2. The user provides a glob pattern (e.g., ../../etc/passwd or ../../var/log/*).
3. The _cleanup function uses Python's glob.glob() or similar to match files.
4. Because the function does not check if the resolved paths are within the intended managed directory (e.g., /var/lib/aim/), a malicious pattern can escape the sandbox.
5. The matched files are then deleted without further verification.

Example Attack Flow:

• Attacker sends a request with glob_pattern = "../../etc/cron.d/*".
• The server resolves this relative to its working directory, potentially deleting cron jobs.
• Alternatively, glob_pattern = "../../home/user/.ssh/authorized_keys" could delete SSH keys, causing denial of service.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), also known as Path Traversal.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

import glob
import os

class LocalFileManager:
    def __init__(self, base_dir):
        self.base_dir = base_dir

    def _cleanup(self, glob_pattern):
        # VULNERABLE: No path validation
        for filepath in glob.glob(glob_pattern, recursive=True):
            os.remove(filepath)

Patched Code (Conceptual):

import glob
import os

class LocalFileManager:
    def __init__(self, base_dir):
        self.base_dir = os.path.abspath(base_dir)

    def _cleanup(self, glob_pattern):
        # SAFE: Resolve pattern relative to base_dir and validate
        full_pattern = os.path.join(self.base_dir, glob_pattern)
        for filepath in glob.glob(full_pattern, recursive=True):
            # Ensure the resolved path is within base_dir
            if os.path.commonpath([os.path.abspath(filepath), self.base_dir]) == self.base_dir:
                os.remove(filepath)
            else:
                # Log or reject the operation
                pass

The patched version uses os.path.commonpath to verify that the resolved file path starts with the managed base directory, preventing path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Aim server version 3.22.0 running on a target.
• Network access to the Aim API (default port 53800).

Exploitation Steps:

1. Identify the Aim API endpoint. The cleanup functionality is typically exposed via a REST API. Use a tool like curl or nmap to discover the endpoint.
2. Craft a malicious glob pattern. For example, to delete all files in /tmp:

   ../../tmp/*
   

3. Send the request. Using curl:

   curl -X POST http://target:53800/api/cleanup \
     -H "Content-Type: application/json" \
     -d '{"glob_pattern": "../../tmp/*"}'
   

4. Verify deletion. Check if files in /tmp have been removed.

Advanced Exploitation:

• Delete SSH authorized keys to lock out administrators.
• Remove critical system binaries (e.g., /bin/ls) to cause denial of service.
• Combine with other vulnerabilities for privilege escalation.

Blue Team (Defense & Detection)

Detection:

• Monitor for unusual API calls to the cleanup endpoint with suspicious glob patterns (e.g., containing ../).
• Log all file deletion operations and correlate with API requests.
• Use file integrity monitoring (FIM) to detect unexpected deletions.

Mitigation:

• Immediately isolate Aim servers if possible.
• Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the glob_pattern parameter.
• Restrict network access to the Aim API to trusted IPs only.
• Apply the principle of least privilege to the Aim process.

Lab Setup for Testing:

1. Install vulnerable Aim:

   pip install aim==3.22.0
   

2. Start the Aim server:

   aim server
   

3. Simulate an attack:

   curl -X POST http://localhost:53800/api/cleanup \
     -H "Content-Type: application/json" \
     -d '{"glob_pattern": "../../tmp/test_file.txt"}'
   

4. Monitor logs: Check Aim server logs for the request and any file deletion errors.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/cleanup with glob_pattern containing ../ or absolute paths.
  • Unusual outbound connections from the Aim server (if attacker exfiltrates data).
• File System IOCs:
  • Unexpected deletion of files outside the Aim data directory.
  • Missing critical system files (e.g., /etc/passwd, /bin/bash).
  • Presence of temporary files created by the attacker.
• Log IOCs:
  • Aim server logs showing _cleanup calls with suspicious patterns.
  • System logs (e.g., auditd) recording file deletion events by the Aim process.

Detection Engineering

YARA Rule

rule CVE_2024_6851_Aim_File_Deletion {
    meta:
        description = "Detects malicious glob patterns targeting CVE-2024-6851 in Aim"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-6851"
    strings:
        $glob_pattern = /glob_pattern["']?\s*[:=]\s*["'][^"']*\.\.\// nocase
        $cleanup_endpoint = "/api/cleanup"
    condition:
        $cleanup_endpoint and $glob_pattern
}

Sigma Rule

title: CVE-2024-6851 Aim Arbitrary File Deletion Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Aim cleanup endpoint with path traversal patterns
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: aim
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/cleanup'
        cs-uri-query|contains: 'glob_pattern'
    filter:
        cs-uri-query|contains: '..'
    condition: selection and filter
falsepositives:
    - Legitimate use of glob patterns with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6851 Aim Arbitrary File Deletion Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/cleanup"; http_uri; content:"glob_pattern"; http_client_body; content:".."; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Aim cleanup API if not required, or restrict access via firewall rules.
2. Implement input validation on the glob_pattern parameter to reject patterns containing ../ or absolute paths.
3. Apply the principle of least privilege to the Aim process, ensuring it can only write to its designated data directory.

Long-term Fix:

• Upgrade to a patched version of Aim once available.
• If no patch is forthcoming, consider forking the repository and applying the fix described in the "Vulnerable vs. Patched Code" section.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /api/cleanup with suspicious patterns:

  location /api/cleanup {
      if ($request_body ~* "\.\.") {
          return 403;
      }
      proxy_pass http://aim_backend;
  }
  

Valters IT – Securing your digital frontier.