CVE-2024-8769: Aim Package Path Traversal Vulnerability Leading to Arbitrary File Deletion
Summary
CVE-2024-8769: Aim path traversal in LockManager.release_locks. Affects aim versions >= 3.15.0, <= 3.27.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Aim package, available on PyPI, is designed for tracking machine learning experiments and managing their associated metadata. It provides functionalities for logging, visualizing, and analyzing experiments, making it a valuable tool for data scientists and machine learning practitioners. However, a critical vulnerability has been identified in the LockManager.release_locks function, which exposes the system to potential security risks.
Vulnerability Detail
A vulnerability exists in the LockManager.release_locks function of the Aim package, specifically in the handling of the run_hash parameter. This parameter is user-controllable and is concatenated into a file path without proper normalization, allowing for relative path traversal. An attacker can exploit this vulnerability through the Repo._close_run() method, which is accessible via the tracking server instruction API. This exploitation can lead to arbitrary file deletion on the server, posing a significant risk to the integrity and security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can restrict access to the tracking server API to trusted users only, thereby minimizing the risk of exploitation until the package is updated. Additionally, consider implementing file system permissions that prevent unauthorized file deletions.
Conclusion
The Aim package has a critical vulnerability (CVE-2024-8769) that allows for arbitrary file deletion due to improper handling of user input in the LockManager.release_locks function. It is crucial to update the package to the latest version to mitigate this risk. Additionally, consider using Vulert to monitor for vulnerabilities in your applications.
See every vulnerability recorded for aim →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to arbitrary file deletion on the server, which may compromise sensitive data and disrupt application functionality.
Yes, a patch is available in version 3.28.0 of the Aim package. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement access controls and file system permissions to limit the risk of exploitation until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for aim.
