CVE-2024-8061

Executive Summary

CVE-2024-8061 is a denial-of-service (DoS) vulnerability in Aimhubio Aim version 3.23.0. The vulnerability arises because certain methods that request data from external servers do not set timeouts, causing the tracking server to wait indefinitely for a response. This blocks the server from handling other requests, leading to a denial of service. The issue is specifically in the client used by the aim tracking server to communicate with external resources, particularly in the _run_read_instructions method and similar calls without timeouts. The CVSS score is 7.5 (High), with a low EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python package aim (Aimhubio Aim) available on PyPI. Organizations using this package in their ML experiment tracking infrastructure should assess their exposure. The lack of timeouts in external resource requests can be exploited by an attacker to cause a DoS condition, potentially impacting ML pipeline operations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: High – An unauthenticated attacker can cause a denial of service by sending a request that triggers an external resource fetch without a timeout, blocking the server.

Deep Dive & Mechanics

The vulnerability is in the aim tracking server's client code that communicates with external resources. The _run_read_instructions method and similar calls do not set a timeout for HTTP requests. When an attacker sends a request that triggers such a call (e.g., by providing a URL that points to a slow or unresponsive server), the tracking server will wait indefinitely for a response. During this wait, the server's event loop is blocked, preventing it from processing other requests. This results in a denial of service.

The root cause is the absence of a timeout parameter in the underlying HTTP client calls. In Python's requests library, this would be the timeout parameter. Without it, the default behavior is to wait indefinitely.

Vulnerable vs. Patched Code

Vulnerable Code (Aim 3.23.0):

# In the client code, e.g., in _run_read_instructions
def _run_read_instructions(self, url):
    response = requests.get(url)  # No timeout set
    # process response

Patched Code (Hypothetical):

def _run_read_instructions(self, url):
    response = requests.get(url, timeout=10)  # Timeout set to 10 seconds
    # process response

The patch would involve adding a timeout parameter to all external HTTP requests made by the tracking server.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Aim tracking server version 3.23.0 running and accessible.
• Ability to send HTTP requests to the server.

Exploitation Steps:

1. Identify an endpoint on the Aim server that triggers an external resource fetch (e.g., a URL parameter in a tracking request).
2. Set up a slow or unresponsive HTTP server (e.g., using nc -l -p 9999 and not sending a response).
3. Send a request to the Aim server with the URL pointing to your slow server:

   POST /api/track HTTP/1.1
   Host: target-aim-server:5000
   Content-Type: application/json
   
   {"url": "http://attacker-server:9999/slow"}
   

4. The Aim server will attempt to fetch the URL and hang indefinitely, blocking other requests.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for long-running HTTP connections from the Aim server to external IPs.
• Look for requests to the Aim server that include URLs pointing to suspicious or slow external hosts.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply a patch if available (currently none).
• Implement a network-level timeout for outbound connections from the Aim server.
• Restrict outbound traffic from the Aim server to only trusted resources.
• Monitor server logs for unresponsive external resource fetches.

Indicators of Compromise (IOCs)

• Network:
  • Outbound connections from the Aim server to external IPs that remain open for an extended period (e.g., > 30 seconds).
  • HTTP requests to the Aim server containing URLs with suspicious or slow external hosts.
• Logs:
  • Server logs showing repeated attempts to fetch external resources without completion.
  • Error messages related to timeouts (if any) or stalled threads.
• System:
  • High number of blocked or waiting threads in the Aim server process.
  • Increased memory or file descriptor usage due to stalled connections.

Detection Engineering

YARA Rule

rule CVE_2024_8061_Aim_DoS {
    meta:
        description = "Detects Aim server code with missing timeout in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8061"
    strings:
        $s1 = "requests.get(" nocase
        $s2 = "requests.post(" nocase
        $s3 = "requests.put(" nocase
        $s4 = "requests.delete(" nocase
        $s5 = "requests.patch(" nocase
        $s6 = "requests.head(" nocase
        $s7 = "requests.options(" nocase
        $s8 = "timeout=" nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7) and not $s8
}

Sigma Rule

title: CVE-2024-8061 Aim Server DoS via Missing Timeout
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Aim server requests that may trigger external resource fetch without timeout
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8061
logsource:
    category: application
    product: aim
detection:
    selection:
        event: "http_request"
        url|contains: "http://"
    condition: selection
falsepositives:
    - Legitimate external resource fetches with timeouts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8061 Aim Server DoS - External Resource Fetch"; flow:to_server; content:"POST"; http_method; content:"/api/track"; http_uri; content:"url"; http_client_body; pcre:"/\"url\"\s*:\s*\"http:\/\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the Aim server – Restrict network access to only trusted clients and resources.
2. Implement network-level timeouts – Use a reverse proxy or firewall to enforce connection timeouts for outbound traffic from the Aim server.
3. Monitor for exploitation – Use the provided detection rules to identify potential attacks.

Long-term Fix:

• Apply a patch from the vendor when available. The fix should add timeouts to all external HTTP requests in the Aim client code.
• Upgrade to a patched version of Aim once released.

Workaround:

• Modify the Aim source code to add timeouts to the _run_read_instructions method and similar calls. For example, change requests.get(url) to requests.get(url, timeout=10).

Valters IT