github.com
https://github.com/wandb/weave CVE-2024-7340
Nuclei
W&B Weave server remote arbitrary file leak and privilege escalation
Record summary
EIP currently links 1 Nuclei template to CVE-2024-7340.
Description
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 31, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unknown | CVE List | Through 0.50.7 | affected |
weaveBrowse PyPI / weave | GitHub Advisory | Before 0.50.8 · Fixed in 0.50.8 | affected |
weaveDefault status: unaffected | CVE List | Through 0.50.7 | affected |
Nuclei templates
1ProjectDiscoveryHIGHW&B Weave Server - Remote Arbitrary File LeakCVSS 8.8
The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.
Impact
Authenticated low-privileged attackers can exploit path traversal to read arbitrary files from the server, potentially accessing sensitive configuration files and credentials to escalate privileges to admin level.
Remediation
Update W&B Weave Server to a version that includes the fix from pull request #1657 addressing the path traversal vulnerability.
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024lfrweavewandbvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
https://github.com/advisories/GHSA-r49h-6qxq-624f https://github.com/wandb/weave/pull/1657 https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248/
Source: ProjectDiscovery
References
5github.com
https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f github.compatch
https://github.com/wandb/weave/pull/1657 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-7340 research.jfrog.comThird-party advisory
https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248