MindsDB has arbitrary file write in file.py

CVE-2023-50731

What is CVE-2023-50731?

MindsDB, a SQL Server designed for artificial intelligence, exhibits a path injection vulnerability in its API. This occurs when user-controlled name values are not validated in the put method, specifically in the file management namespace. Unauthorized users can exploit this weakness to manipulate temporary file names, leading to potential unauthorized file access and arbitrary file writing. While MindsDB attempts file type checks post-write, the lack of initial validation allows potentially dangerous files to persist on the server, which also enables attackers to delete critical zip or tar.gz files. Security updates are essential to mitigate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References