PT-2023-23176 · Mage Ai · Mage Ai

Kentaro Ishii · Published 2023-05-05 · Updated 2023-05-16 · CVE-2023-31143

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions mage-ai versions 0.8.34 through 0.8.71

Description The issue affects mage-ai, an open-source data pipeline tool, when used with user authentication enabled. It allows the terminal to be accessed by users who are not signed in or do not have editor permissions.

Recommendations For versions 0.8.34 through 0.8.71, update to version 0.8.72 to resolve the issue. As a temporary workaround, consider disabling user authentication until the update can be applied. Restrict access to the terminal to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-31143

GHSA-C6MM-2G84-V4M7

PYSEC-2023-64

Affected Products

Mage Ai

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31143.json · Exploit
• https://github.com/mage-ai/mage-ai/commit/f63cd00f6a3be372397d37a4c9a49bfaf50d7650 · Patch
• https://github.com/mage-ai/mage-ai/security/advisories/GHSA-c6mm-2g84-v4m7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31143 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-64 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6mm-2g84-v4m7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31143 · Vendor Advisory
• https://github.com/mage-ai/mage-ai · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mage-ai/PYSEC-2023-64.yaml · Note
• https://t.me/cvenotify/50042 · Telegram Post
• https://t.me/cibsecurity/63620 · Telegram Post