PT-2023-31353 · Mindsdb · Mindsdb

Sylwia-Budzynska · Published 2023-12-11 · Updated 2023-12-14 · CVE-2023-49795

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 23.11.4.1

Description MindsDB connects artificial intelligence models to real-time data. The issue is related to a server-side request forgery vulnerability in the file.py module. This can lead to limited information disclosure, allowing for the retrieval of files with specific extensions and potentially scanning internal networks for open ports or existing files. The vulnerability is due to the lack of validation of user-controlled URLs in the source variable, which can be used to create arbitrary requests.

Recommendations For versions prior to 23.11.4.1, use MindsDB's staging branch or update to version 23.11.4.1, which contains a fix for the issue. As a temporary workaround, consider restricting access to the file.py module or disabling the functionality that uses the source variable until a patch is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-49795

GHSA-34MR-6Q8X-G9R6

PYSEC-2023-277

Affected Products

Mindsdb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49795.json · Exploit
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-34mr-6q8x-g9r6 · Vendor Advisory
• https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-49795 · Security Note
• https://osv.dev/vulnerability/GHSA-34mr-6q8x-g9r6 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49795 · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-277.yaml · Note
• https://twitter.com/CVEnew/status/1734290258580173254 · Twitter Post