Eine Cross-Site Request Forgery (CSRF) Schwachstelle in allen Versionen bis zu 1.14.1 der api server Komponente der ClearML Plattform von Allegro AI ermöglicht es einem Remote-Angreifer, einen Benutzer zu imitieren, indem er AP

The impact of this CSRF vulnerability is significant, allowing an attacker to effectively hijack user sessions within the ClearML platform. By crafting malicious HTML and tricking a legitimate user into visiting it, the attacker can execute arbitrary API requests as that user. This could involve creating, deleting, or modifying workspaces, accessing sensitive data stored within those workspaces, and potentially gaining control over the entire ClearML instance. The ability to target instances within closed networks amplifies the risk, as attackers could bypass external security controls and directly compromise internal systems. The potential for data exfiltration and unauthorized modifications makes this a high-priority vulnerability to address.

Organizations utilizing ClearML for machine learning experiment tracking and management are at risk. This includes teams managing sensitive data within ClearML workspaces, particularly those operating within closed or isolated network environments. Users who have not implemented robust authentication and authorization controls are also at increased risk.

• python / server:

# Check for ClearML version
import requests
import json

url = 'http://your-clearml-server/api/v1/info'

try:
    response = requests.get(url)
    response.raise_for_status()
    data = response.json()
    version = data.get('version', 'Unknown')
    print(f'ClearML Version: {version}')
    if version and float(version) < 1.14.2:
        print('VULNERABLE: ClearML version is less than 1.14.2')
    else:
        print('ClearML version is patched.')
except requests.exceptions.RequestException as e:
    print(f'Error connecting to ClearML server: {e}')

1. 2024-02-06Disclosure

   disclosure

1. Reserviert2024-01-25
2. Veröffentlicht2024-02-06
3. Geändert2025-06-17
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-24593 is to immediately upgrade to ClearML version 1.14.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as implementing strict input validation and output encoding on all API endpoints to prevent malicious data from being processed. Additionally, enforce strong user authentication and authorization policies to limit the potential impact of a successful CSRF attack. Web application firewalls (WAFs) configured to detect and block CSRF attacks can provide an additional layer of defense. After upgrading, confirm the fix by attempting to trigger an API request through a crafted HTML page and verifying that it fails with an authentication error.