PT-2023-31629 · Mindsdb · Mindsdb

Sylwia-Budzynska · Published 2023-12-15 · Updated 2024-01-05 · CVE-2023-50731

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions MindsDB versions prior to 23.11.4.1

Description The issue concerns a path injection vulnerability in the put method of mindsdb/mindsdb/api/http/namespaces/file.py. This vulnerability allows arbitrary file contents to be written due to the lack of validation of the user-controlled name value used in a temporary file name. The temporary directory is deleted, but the potentially dangerous file remains due to the path injection. Additionally, there is another path injection sink that allows an attacker to delete any zip or tar.gz files on the server. The check for specific file types (csv, json, parquet, xls, or xlsx) occurs after the file has been written, resulting in the file remaining on the server, even though an error is returned.

Recommendations For MindsDB versions prior to 23.11.4.1, use the mindsdb staging branch or update to version 23.11.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the put method in mindsdb/mindsdb/api/http/namespaces/file.py to minimize the risk of exploitation. Avoid using the name value in the affected API endpoint until the issue is resolved.

Exploit

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

Related Identifiers

CVE-2023-50731

GHSA-J8W6-2R9H-CXHJ

PYSEC-2023-279

Affected Products

Mindsdb

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50731.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-182_GHSL-2023-184_mindsdb_mindsdb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-50731 · Security Note
• https://osv.dev/vulnerability/GHSA-j8w6-2r9h-cxhj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50731 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-279 · Vendor Advisory
• https://github.com/mindsdb/mindsdb · Note
• https://github.com/mindsdb/mindsdb/security/advisories/GHSA-j8w6-2r9h-cxhj · Note
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L138 · Note
• https://github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-279.yaml · Note
• https://t.me/cvenotify/66355 · Telegram Post