CVE-2024-2083 Directory Traversal in zenml-io/zenml
Attackers can read arbitrary files by manipulating the logs URI path in the ZenML API, bypassing access restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-2083?
CVE-2024-2083 is a critical path traversal vulnerability in zenml-io/zenml, published on 16 Apr 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
Weakness: CWE-29
Which versions are affected by CVE-2024-2083?
3 open source packages ship an affected version, including zenml. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zenml PyPI | All versions | 0.55.5 |
zenml PyPI | All versions | 0.55.5 |
zenml PyPI | All versions | 0.55.5 |
Products include Zenml Zenml.
How do I fix CVE-2024-2083?
Upgrade zenml to 0.55.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-2083 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2083 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in zenml-io/zenml
Sources
Also known as GHSA-6h3f-43vq-53hj, PYSEC-2024-247.