Attackers can steal sensitive data from CVAT users

CVE-2024-37306

What is CVE-2024-37306?

The Computer Vision Annotation Tool (CVAT) prior to version 2.14.3 is susceptible to an arbitrary file overwrite vulnerability. This issue arises when an attacker successfully deceives a logged-in CVAT user into navigating to a malicious URL. Upon doing so, the attacker can trigger a dataset export or backup from projects, tasks, or jobs that the victim user has authorization to access. The attacker can then specify the name of the resulting file, potentially leading to overwriting of arbitrary files in any accessible cloud storage. Moreover, if the attacker possesses read access to the victim's cloud storage, they have the capability to extract sensitive media files, annotations, settings, and other pertinent information from the projects that the victim can export. Version 2.14.3 addresses this security issue. Currently, no workarounds are available.

References