FKIE_CVE-2024-1961

Vulnerability from fkie_nvd - Published: 2024-04-16 00:15 - Updated: 2024-11-21 08:51
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the 'artifact_path' parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application's configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application.
References
security@huntr.devhttps://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3
af854a3a-2127-422b-91ae-364da2661108https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the \u0027artifact_path\u0027 parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application\u0027s configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application."
    },
    {
      "lang": "es",
      "value": "vertaai/modeldb es vulnerable a un ataque de path traversal debido a una sanitizaci\u00f3n inadecuada de las rutas de archivos proporcionadas por el usuario en su funcionalidad de carga de archivos. Los atacantes pueden aprovechar esta vulnerabilidad para escribir archivos arbitrarios en cualquier parte del sistema de archivos manipulando el par\u00e1metro \u0027artifact_path\u0027. Esta falla puede provocar la ejecuci\u00f3n remota de c\u00f3digo (RCE) al sobrescribir archivos cr\u00edticos, como el archivo de configuraci\u00f3n de la aplicaci\u00f3n, especialmente cuando la aplicaci\u00f3n se ejecuta fuera de Docker. La vulnerabilidad est\u00e1 presente en los componentes NFSController.java y NFSService.java de la aplicaci\u00f3n."
    }
  ],
  "id": "CVE-2024-1961",
  "lastModified": "2024-11-21T08:51:41.460",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-04-16T00:15:10.867",
  "references": [
    {
      "source": "security@huntr.dev",
      "url": "https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.