PT-2023-31354 · Mindsdb · Mindsdb

Sylwia-Budzynska · Published 2023-12-11 · Updated 2023-12-14 · CVE-2023-49796

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 23.11.4.1

Description MindsDB connects artificial intelligence models to real-time data. The issue is related to a limited file write vulnerability in the file.py module. This vulnerability may lead to arbitrary file write, allowing files to be written anywhere on the server that the filesystem permissions of the running server have access to. The put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name and can lead to path injection.

Recommendations For versions prior to 23.11.4.1, use MindsDB's staging branch or update to version 23.11.4.1, which contains a fix for the issue. As a temporary workaround, consider restricting access to the file.py module until the issue is resolved. Avoid using the name variable in the affected API endpoint until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-49796

GHSA-CRHP-7C74-CG4C

PYSEC-2023-278

Affected Products

Mindsdb

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49796.json · Exploit
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c · Vendor Advisory
• https://github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe · Patch
• https://osv.dev/vulnerability/GHSA-crhp-7c74-cg4c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49796 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49796 · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-278.yaml · Note
• https://twitter.com/CVEnew/status/1734315191951622488 · Twitter Post
• https://t.me/cvenotify/63242 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1734358284142854465 · Twitter Post