CVE-2024-7760: Aim Package Vulnerable to Cross-Site Request Forgery Due to Overly Permissive CORS Settings
Summary
CVE-2024-7760: Aim vulnerable to Cross-Site Request Forgery. Affects aim versions < 3.22.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aim package, available on PyPI, is designed for tracking and analyzing machine learning experiments. It provides a user-friendly interface for managing and visualizing data, making it a popular choice among data scientists and machine learning practitioners. However, the package has been identified to have a significant security vulnerability that could expose users to various attacks.
Vulnerability Detail
The vulnerability identified as CVE-2024-7760 in Aim version 3.22.0 is a Cross-Site Request Forgery (CSRF) issue stemming from overly permissive CORS (Cross-Origin Resource Sharing) settings. This flaw allows malicious actors to send unauthorized requests to the tracking server from any origin, potentially leading to CSRF attacks on all endpoints. The implications of this vulnerability are severe, as it can be exploited in conjunction with other vulnerabilities, such as remote code execution, denial of service, and arbitrary file read/write, thereby compromising the integrity and confidentiality of the application.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict CORS settings on your server to allow only trusted origins. This can be done by configuring your server to specify allowed origins explicitly, rather than allowing all origins. For example, in a Flask application, you can set CORS like this: CORS(app, resources={r'/*': {'origins': ['https://your-trusted-origin.com']}}).
Conclusion
The Aim package has a critical vulnerability (CVE-2024-7760) that poses serious security risks due to CSRF attacks enabled by lax CORS settings. Users are strongly encouraged to update to the latest version to protect their applications. Additionally, implementing stricter CORS policies can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for aim →
FAQ
CVE-2024-7760 is a security vulnerability in the Aim package that allows Cross-Site Request Forgery due to overly permissive CORS settings.
If exploited, this vulnerability can allow attackers to perform unauthorized actions on behalf of users, potentially leading to data breaches or service disruptions.
You should immediately update to the latest version of Aim to mitigate the vulnerability. Use the command pip install --upgrade aim.
Yes, you can restrict CORS settings on your server to only allow trusted origins as a temporary measure.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for aim.
