Cross-Site Request Forgery Vulnerability in AimHubio Tracking Server

CVE-2024-7760

Summary

AimHubio's Aim version 3.22.0 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability due to overly permissive CORS settings. This flaw allows for cross-origin requests from any source, enabling attackers to exploit all endpoints of the tracking server. The CSRF attacks could be leveraged in conjunction with other vulnerabilities, potentially facilitating remote code execution, denial of service, and arbitrary file read/write, thereby posing significant security challenges.

References