Allegro AIのClearMLプラットフォームのウェブサーバーコンポーネントの全バージョンにおいて、クロスサイトスクリプティング (XSS) の脆弱性が存在し、リモートの攻撃者がユーザーがDを表示する際にJavaScriptペイロードを実行できる可能性があります。

The impact of this XSS vulnerability is significant. An attacker could leverage it to steal sensitive user data, including credentials and personally identifiable information (PII), by injecting malicious scripts into the Debug Samples tab. Successful exploitation could also lead to session hijacking, allowing the attacker to impersonate legitimate users and gain unauthorized access to the ClearML platform. The scope of potential impact extends to any user accessing the Debug Samples tab, potentially affecting a wide range of ClearML deployments.

Organizations heavily reliant on ClearML for machine learning experiment tracking and management are particularly at risk. Teams frequently utilizing the Debug Samples tab for troubleshooting and analysis are also highly vulnerable. Shared hosting environments where ClearML is deployed alongside other applications could expose a broader range of users to potential compromise.

• python / server: Inspect ClearML logs for unusual JavaScript execution patterns or requests targeting the Debug Samples tab. Use Python's requests library to test for XSS by injecting payloads into the Debug Samples tab and observing the response.

import requests
url = 'YOUR_CLEARML_URL/debug_samples'
payload = '<script>alert("XSS")</script>'
response = requests.get(url, params={'debug_sample': payload})
print(response.text)

• generic web: Monitor web server access logs for requests containing suspicious JavaScript code in the URL parameters or POST data, specifically targeting the /debug_samples endpoint.

1. 2024-02-06Disclosure

   disclosure

1. 予約済み2024-01-25
2. 公開日2024-02-06
3. 更新日2024-08-01
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2024-24594 is to upgrade to a patched version of ClearML as soon as it becomes available. Until the upgrade can be performed, implement temporary mitigations such as configuring a Web Application Firewall (WAF) to filter out potentially malicious JavaScript payloads targeting the Debug Samples tab. Additionally, review and restrict access to the Debug Samples tab to only authorized personnel to minimize the attack surface. Thoroughly test any configuration changes in a non-production environment before applying them to production systems.