Platform
python
Component
aim
Fixed in
3.25.1
CVE-2024-2195 is a critical Remote Code Execution (RCE) vulnerability affecting aimhubio/aim versions 3.0.0 and earlier, up to and including 3.25.0. This vulnerability allows attackers to execute arbitrary commands on the server, potentially leading to complete system compromise. The flaw resides in the /api/runs/search/run/ endpoint, where insufficient access controls permit unauthorized code execution. A patch is available.
The impact of CVE-2024-2195 is severe. An attacker exploiting this vulnerability can execute arbitrary commands with the privileges of the application user on the affected server. This could lead to complete system compromise, including data exfiltration, malware installation, and denial of service. The vulnerability's location within the API endpoint suggests a high degree of accessibility, potentially allowing remote attackers to exploit it without requiring authentication, depending on the overall aimhubio/aim deployment configuration. Successful exploitation could mirror the impact of other RCE vulnerabilities where attackers gain root access and full control over the system.
CVE-2024-2195 was publicly disclosed on April 10, 2024. The vulnerability's critical CVSS score and ease of exploitation suggest a high probability of exploitation. As of this writing, there are no publicly available exploits, but the vulnerability is listed on KEV (CISA Known Exploited Vulnerabilities) catalog. Monitor security advisories and threat intelligence feeds for any signs of active exploitation campaigns.
Exploit Status
EPSS
8.38% (92% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-2195 is to upgrade aimhubio/aim to a version with the security patch. Consult the aimhubio/aim project's release notes for the latest patched version. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting access to the /api/runs/search/run/ endpoint using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests with suspicious or overly complex query parameters. Thoroughly review and validate all user inputs to the query parameter to prevent malicious code injection. After upgrading, confirm the vulnerability is resolved by attempting a controlled code execution attempt through the /api/runs/search/run/ endpoint with a benign command.
Update aimhubio/aim to the latest available version. This will resolve the remote code execution vulnerability. See the release notes for more details about the update.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-2195 is a critical Remote Code Execution vulnerability in aimhubio/aim versions up to 3.25.0, allowing attackers to execute arbitrary code via the /api/runs/search/run/ endpoint.
You are affected if you are running aimhubio/aim versions between 3.0.0 and 3.25.0 (inclusive).
Upgrade to a patched version of aimhubio/aim. Consult the project's release notes for the latest version. Implement WAF rules as a temporary workaround.
While no public exploits are currently available, the vulnerability's critical severity and KEV listing suggest a high probability of exploitation.
Refer to the aimhubio/aim project's official release notes and security advisories on their GitHub repository.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.