Platform
python
Component
mesop
Fixed in
0.9.1
0.12.4
CVE-2024-45601 describes a file access vulnerability discovered and resolved in Mesop. This flaw stems from inadequate input validation within a specific endpoint, potentially allowing attackers to retrieve files not intended for public access. The vulnerability affects Mesop versions up to and including 0.9.5rc0. A fix is available in version 0.12.4, and users are strongly encouraged to upgrade immediately.
Successful exploitation of CVE-2024-45601 could grant an attacker unauthorized access to sensitive files hosted on the Mesop server. The scope of accessible files depends on the server's configuration and file permissions, but could include configuration files, source code, or even user data. This could lead to data breaches, intellectual property theft, or further compromise of the system. While no specific real-world precedent is cited, the potential for sensitive data exposure makes this a significant risk. The attacker could potentially leverage this access to gain a deeper understanding of the application's architecture and identify further vulnerabilities.
CVE-2024-45601 was publicly disclosed on September 18, 2024. The vulnerability was reported by @Letm3through, who also proposed mitigations. The CVSS score of 7.5 (HIGH) indicates a moderate probability of exploitation. There are currently no publicly available proof-of-concept exploits, but the ease of exploitation (requiring only crafted input) suggests that one may emerge. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.13% (32% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-45601 is to upgrade Mesop to version 0.12.4 or later, which includes the necessary input validation fix. If immediate upgrading is not possible due to compatibility issues or downtime constraints, consider implementing a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint, specifically targeting suspicious input patterns. Carefully review and restrict file permissions on the Mesop server to limit the potential impact of a successful attack. There are no specific Sigma or YARA rules available at this time, but monitoring access logs for unusual file requests is recommended.
Actualice Mesop a la versión 0.12.4 o superior. Esto solucionará la vulnerabilidad de inclusión de archivos locales. Puede actualizar usando `pip install --upgrade mesop`.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-45601 is a HIGH severity vulnerability in Mesop versions ≤0.9.5rc0 that allows unauthorized access to files due to insufficient input validation. Upgrade to 0.12.4 to resolve.
Yes, if you are running Mesop version 0.9.5rc0 or earlier, you are affected by this vulnerability and should upgrade immediately.
Upgrade Mesop to version 0.12.4 or later. As a temporary workaround, implement a WAF rule to block suspicious requests to the vulnerable endpoint.
There are currently no confirmed reports of active exploitation, but the vulnerability's ease of exploitation suggests it could be targeted.
Refer to the Mesop project's official website or GitHub repository for the latest security advisory and release notes.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.