PT-2024-21820 · Unknown · Refuel Autolabel Library

Kasimir Schulz + 1 · Published 2024-09-12 · Updated 2024-09-23 · CVE-2024-27320

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Refuel Autolabel library versions 0.0.8 and newer

Description An arbitrary code execution issue exists due to the way the Refuel Autolabel library handles provided CSV files in its classification tasks. If a maliciously crafted CSV file containing Python code is used to create a classification task, the code will be executed by an eval function.

Recommendations For Refuel Autolabel library versions 0.0.8 and newer, consider disabling the classification task feature that handles CSV files until a patch is available to prevent arbitrary code execution. Restrict the use of the eval function in classification tasks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Eval Injection

Weakness Enumeration

CWE-1236

CWE-95

Related Identifiers

CVE-2024-27320

GHSA-G2M8-F3X2-QPRW

Affected Products

Refuel Autolabel Library

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-27320 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27320 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g2m8-f3x2-qprw · Vendor Advisory
• https://github.com/refuel-ai/autolabel · Note
• https://github.com/refuel-ai/autolabel/blob/v0.0.16/src/autolabel/dataset/validation.py#L57-L79 · Note
• https://hiddenlayer.com/sai-security-advisory/2024-09-autolabel · Note
• https://twitter.com/cracbot/status/1835921709402308732 · Twitter Post
• https://twitter.com/CVEnew/status/1834215100590301595 · Twitter Post
• https://t.me/cvedetector/5474 · Telegram Post
• https://t.me/cvenotify/95640 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1834238994604769347 · Twitter Post