by Kastro
Paper/Archive/CVE-2024-8019

CVE-2024-8019

lightning-ai lightning-ai/pytorch-lightning — Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
51
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 66.2.662 × 2013.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerability occurs at the `/api/v1/upload_file/` endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.

Affected

ProductAffectedFixed inSource
lightning-ai/pytorch-lightningunspecified – < 2.3.32.3.3CNA

Scores by source

@huntr_ai (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refhuntr.com/bounties/2754298b-5af5-48ef-8b38-999093ddf2bdrefgithub.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a