CVE-2024-6396

CRITICALNuclei

Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-6396 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 16, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 12, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

AIM

Browse Aimhubio / AIM

Default status: unknown

VulnCheck, CVE List3.19.3affected

aimhubio/aim

Browse aimhubio / aimhubio/aim
CVE ListThrough latestaffected

Nuclei templates

1
ProjectDiscoveryCRITICALAimhubio Aim Server 3.19.3 - Arbitrary File OverwriteCVSS 9.8

A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

Impact

Unauthenticated attackers can overwrite arbitrary files on the host server and exfiltrate data by manipulating the _backup_run function parameters, potentially achieving denial of service, data loss, or remote code execution.

Remediation

Update Aimhubio Aim to version 3.19.4 or later to address the arbitrary file overwrite vulnerability.

WeaknessesCWE-29
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024aimaimhubiofile-writevkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:aimstack:aim:*:*:*:*:*:*:*:*
FOFA: icon_hash="-1047157256"

Source: ProjectDiscovery

References

2