by Kastro
Paper/Archive/CVE-2024-2195

CVE-2024-2195

aimhubio aimhubio/aim — Remote Code Execution in aimhubio/aim

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
55
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.7.787 × 2015.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.

Affected

ProductAffectedFixed inSource
aimhubio/aimunspecified – latest–CNA
aim3.0.0 – *–CISA-ADP

Scores by source

@huntr_ai (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018