Allegro AI के ClearML प्लेटफॉर्म के वेब सर्वर घटक के सभी संस्करणों में एक क्रॉस-साइट स्क्रिप्टिंग (XSS) भेद्यता एक दूरस्थ हमलावर को जावास्क्रिप्ट पेलोड निष्पादित करने की अनुमति देती है जब कोई उपयोगकर्ता D देखता है

The impact of this XSS vulnerability is significant. An attacker could leverage it to steal sensitive user data, including credentials and personally identifiable information (PII), by injecting malicious scripts into the Debug Samples tab. Successful exploitation could also lead to session hijacking, allowing the attacker to impersonate legitimate users and gain unauthorized access to the ClearML platform. The scope of potential impact extends to any user accessing the Debug Samples tab, potentially affecting a wide range of ClearML deployments.

Organizations heavily reliant on ClearML for machine learning experiment tracking and management are particularly at risk. Teams frequently utilizing the Debug Samples tab for troubleshooting and analysis are also highly vulnerable. Shared hosting environments where ClearML is deployed alongside other applications could expose a broader range of users to potential compromise.

• python / server: Inspect ClearML logs for unusual JavaScript execution patterns or requests targeting the Debug Samples tab. Use Python's requests library to test for XSS by injecting payloads into the Debug Samples tab and observing the response.

import requests
url = 'YOUR_CLEARML_URL/debug_samples'
payload = '<script>alert("XSS")</script>'
response = requests.get(url, params={'debug_sample': payload})
print(response.text)

• generic web: Monitor web server access logs for requests containing suspicious JavaScript code in the URL parameters or POST data, specifically targeting the /debug_samples endpoint.

1. 2024-02-06Disclosure

   disclosure

1. आरक्षित2024-01-25
2. प्रकाशित2024-02-06
3. संशोधित2024-08-01
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-24594 is to upgrade to a patched version of ClearML as soon as it becomes available. Until the upgrade can be performed, implement temporary mitigations such as configuring a Web Application Firewall (WAF) to filter out potentially malicious JavaScript payloads targeting the Debug Samples tab. Additionally, review and restrict access to the Debug Samples tab to only authorized personnel to minimize the attack surface. Thoroughly test any configuration changes in a non-production environment before applying them to production systems.