Remote Code Execution Vulnerability in Aimhubio Aim Project

CVE-2024-2195

Summary

A significant vulnerability has been identified in the Aimhubio Aim Project, specifically impacting the API provided for managing runs. This security flaw is present in versions starting from 3.0.0 and arises from inadequate access control mechanisms. The vulnerability is situated within the run_search_api function located in aim/web/api/runs/views.py, where an attacker can exploit improper restrictions to execute arbitrary commands on the server through the query parameter. Successful exploitation of this vulnerability may lead to severe consequences, including complete system compromise. Users of the affected product should take immediate action to patch their systems and prevent potential intrusions.

References