PT-2023-31354 · Mindsdb · Mindsdb

Sylwia-Budzynska · Publicado 2023-12-11 · Atualizado 2023-12-14 · CVE-2023-49796

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 23.11.4.1

Description MindsDB connects artificial intelligence models to real-time data. The issue is related to a limited file write vulnerability in the file.py module. This vulnerability may lead to arbitrary file write, allowing files to be written anywhere on the server that the filesystem permissions of the running server have access to. The put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name and can lead to path injection.

Recommendations For versions prior to 23.11.4.1, use MindsDB's staging branch or update to version 23.11.4.1, which contains a fix for the issue. As a temporary workaround, consider restricting access to the file.py module until the issue is resolved. Avoid using the name variable in the affected API endpoint until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-49796

GHSA-CRHP-7C74-CG4C

PYSEC-2023-278

Produtos afetados

Mindsdb

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49796.json · Exploit
• https://github.com/mindsdb/mindsdb · Nota
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c · Aviso do Fabricante
• https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe · Correção
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-278.yaml · Nota
• https://osv.dev/vulnerability/GHSA-crhp-7c74-cg4c · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1734315191951622488 · Publicação no Twitter
• https://t.me/cvenotify/63242 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1734358284142854465 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-49796 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-278 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-49796 · Aviso do Fabricante