MindsDB has arbitrary file write in file.py

CVE-2023-50731

What is CVE-2023-50731?

MindsDB, a SQL Server designed for artificial intelligence, exhibits a path injection vulnerability in its API. This occurs when user-controlled name values are not validated in the put method, specifically in the file management namespace. Unauthorized users can exploit this weakness to manipulate temporary file names, leading to potential unauthorized file access and arbitrary file writing. While MindsDB attempts file type checks post-write, the lack of initial validation allows potentially dangerous files to persist on the server, which also enables attackers to delete critical zip or tar.gz files. Security updates are essential to mitigate this vulnerability.

References