CVAT Vulnerability Allows Attacker to Probe Network and Overwrite Files

CVE-2024-37164

What is CVE-2024-37164?

The Computer Vision Annotation Tool (CVAT) is designed for interactive video and image annotation. A vulnerability exists that permits users with CVAT accounts to specify custom endpoint URLs that utilize intranet IP addresses or internal domain names. This flaw enables an attacker to scan the internal network for accessible HTTP(S) servers. If the exploited network hosts a web server compatible with Amazon S3 or Azure Blob Storage APIs and is either open for anonymous access or requires known credentials, the attacker gains unauthorized access to data. They may perform operations such as listing files, downloading supported file types like media data, annotation datasets, project backups, and potentially overwriting existing server files with their data. Upgrading to CVAT 2.14.3 is critical to implement essential SSRF mitigations, which block default access to intranet IP addresses. Additional security measures include utilizing virtual networks and firewalls to safeguard internal server access.

References