CVE-2023-31143 Mage terminal user authentication not working properly

Medium 5.9 Published 9 May 2023 Updated 28 Jan 2025

Unauthenticated users can access the terminal in Mage data pipeline tool when authentication is enabled, allowing unauthorized code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-31143?

CVE-2023-31143 is a medium-severity missing authorization vulnerability in mage-ai, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mage-ai is an open-source data pipeline tool for transforming and integrating data. Those who use Mage starting in version 0.8.34 and prior to 0.8.72 with user authentication enabled may be affected by a vulnerability. The terminal could be accessed by users who are not signed in or do not have editor permissions. Version 0.8.72 contains a fix for this issue.

Weakness: CWE-306

Which versions are affected by CVE-2023-31143?

3 open source packages ship an affected version, including mage-ai. It affects 1 product.

Package	Affected	Fixed in
`mage-ai` PyPI	From `0.8.34`	`0.8.72`
`mage-ai` PyPI	From `0.8.34`	`0.8.72`
`mage-ai` PyPI	From `0.8.34`	`0.8.72`

Products include Mage Mage-Ai.

How do I fix CVE-2023-31143?

Upgrade mage-ai to 0.8.72 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-31143 being exploited?

There is no known exploitation of CVE-2023-31143 in the wild and no public exploit code.

Sources

Also known as GHSA-c6mm-2g84-v4m7, PYSEC-2023-64.