cve-2024-1961
Vulnerability from cvelistv5
Published
2024-04-16 00:00
Modified
2024-08-29 19:26
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the 'artifact_path' parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application's configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application.
References
security@huntr.devhttps://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3
af854a3a-2127-422b-91ae-364da2661108https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3
Impacted products
Vendor Product Version
vertaai vertaai/modeldb Version: unspecified   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:56:22.583Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vertaai:modeldb:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "modeldb",
            "vendor": "vertaai",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1961",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T15:12:46.683855Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-29T19:26:57.248Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vertaai/modeldb",
          "vendor": "vertaai",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the \u0027artifact_path\u0027 parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application\u0027s configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-16T11:10:54.747Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3"
        }
      ],
      "source": {
        "advisory": "5f602914-3e5d-407a-b8ce-fb444a4e8bb3",
        "discovery": "EXTERNAL"
      },
      "title": "Path Traversal leading to Arbitrary File Write and RCE in vertaai/modeldb"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-1961",
    "datePublished": "2024-04-16T00:00:15.706Z",
    "dateReserved": "2024-02-27T21:30:47.630Z",
    "dateUpdated": "2024-08-29T19:26:57.248Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-1961\",\"sourceIdentifier\":\"security@huntr.dev\",\"published\":\"2024-04-16T00:15:10.867\",\"lastModified\":\"2024-11-21T08:51:41.460\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the \u0027artifact_path\u0027 parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application\u0027s configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application.\"},{\"lang\":\"es\",\"value\":\"vertaai/modeldb es vulnerable a un ataque de path traversal debido a una sanitizaci\u00f3n inadecuada de las rutas de archivos proporcionadas por el usuario en su funcionalidad de carga de archivos. Los atacantes pueden aprovechar esta vulnerabilidad para escribir archivos arbitrarios en cualquier parte del sistema de archivos manipulando el par\u00e1metro \u0027artifact_path\u0027. Esta falla puede provocar la ejecuci\u00f3n remota de c\u00f3digo (RCE) al sobrescribir archivos cr\u00edticos, como el archivo de configuraci\u00f3n de la aplicaci\u00f3n, especialmente cuando la aplicaci\u00f3n se ejecuta fuera de Docker. La vulnerabilidad est\u00e1 presente en los componentes NFSController.java y NFSService.java de la aplicaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3\",\"source\":\"security@huntr.dev\"},{\"url\":\"https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Path Traversal leading to Arbitrary File Write and RCE in vertaai/modeldb\", \"providerMetadata\": {\"orgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"shortName\": \"@huntr_ai\", \"dateUpdated\": \"2024-04-16T11:10:54.747Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its file upload functionality. Attackers can exploit this vulnerability to write arbitrary files anywhere in the file system by manipulating the \u0027artifact_path\u0027 parameter. This flaw can lead to Remote Code Execution (RCE) by overwriting critical files, such as the application\u0027s configuration file, especially when the application is run outside of Docker. The vulnerability is present in the NFSController.java and NFSService.java components of the application.\"}], \"affected\": [{\"vendor\": \"vertaai\", \"product\": \"vertaai/modeldb\", \"versions\": [{\"version\": \"unspecified\", \"status\": \"affected\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"latest\"}]}], \"references\": [{\"url\": \"https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3\"}], \"metrics\": [{\"cvssV3_0\": {\"version\": \"3.0\", \"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\"}}], \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"lang\": \"en\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"cweId\": \"CWE-22\"}]}], \"source\": {\"advisory\": \"5f602914-3e5d-407a-b8ce-fb444a4e8bb3\", \"discovery\": \"EXTERNAL\"}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T18:56:22.583Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://huntr.com/bounties/5f602914-3e5d-407a-b8ce-fb444a4e8bb3\", \"tags\": [\"x_transferred\"]}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-1961\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-07T15:12:46.683855Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:vertaai:modeldb:-:*:*:*:*:*:*:*\"], \"vendor\": \"vertaai\", \"product\": \"modeldb\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-28T18:56:06.750Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-1961\", \"assignerOrgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"@huntr_ai\", \"dateReserved\": \"2024-02-27T21:30:47.630Z\", \"datePublished\": \"2024-04-16T00:00:15.706Z\", \"dateUpdated\": \"2024-08-29T19:26:57.248Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.