CVE-2024-24590

HIGH

Allegro AI ClearML vulnerable to deserialization of untrusted data

Title source: GitHub Advisory
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-24590 has a selected CVSS score of 8.0 (high); EIP currently links 6 repository PoCs.

Description

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
6

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 8, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

ClearML

Browse Allegro.AI / ClearML

Default status: affected

CVE List0.17.0 to < 1.14.3affected

clearml

Browse PyPI / clearml
GitHub Advisory0.17.0 to ≤ 1.14.1affected

Proofs of concept

6

Repository PoCs

GitHubOxyDeV2/ClearML-CVE-2024-24590Repository PoCby OxyDeV26Not analyzed2 files

3.3 KiB

GitHub
PoC details
GitHubrippsec/CVE-2024-24590-ClearML-RCE-ExploitRepository PoCby rippsec6Not analyzed4 files

19.4 KiB

GitHub
PoC details
GitHubdiegogarciayala/CVE-2024-24590-ClearML-RCE-CMD-POCRepository PoCby diegogarciayala9Not analyzed2 files

4.5 KiB

GitHub
PoC details
GitHubjunnythemarksman/CVE-2024-24590Repository PoCby junnythemarksman1Not analyzed2 files

1.9 KiB

GitHub
PoC details
GitHubsviim/ClearML-CVE-2024-24590-RCERepository PoCby sviim4Not analyzed2 files

1.2 KiB

GitHub
PoC details
GitHubj3r1ch0123/CVE-2024-24590Repository PoCby j3r1ch01230Not analyzed2 files

1.7 KiB

GitHub
PoC details

References

3