PT-2024-27464 · Cvat · Cvat

Speclad · Published 2024-06-13 · Updated 2025-01-21 · CVE-2024-37306

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Computer Vision Annotation Tool (CVAT) versions 2.2.0 through 2.14.3

Description The issue allows an attacker to initiate a dataset export or a backup from a project, task, or job that the victim user has permission to export into a cloud storage that the victim user has access to, by tricking a logged-in CVAT user into visiting a malicious URL. The attacker can choose the name of the resulting file, which implies they can overwrite arbitrary files in any cloud storage the victim can access. If the attacker has read access to the cloud storage used in the attack, they can obtain media files, annotations, settings, and other information from any projects, tasks, or jobs that the victim has permission to export.

Recommendations For versions prior to 2.14.3, update to version 2.14.3 to resolve the issue. As a temporary workaround, consider restricting access to cloud storage for CVAT users to minimize the risk of exploitation. Avoid using CVAT to export datasets or backups to cloud storage until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-37306

GHSA-JPF9-646H-4PX7

Affected Products

Cvat

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37306.json · Exploit
• https://github.com/cvat-ai/cvat/commit/5d36d10e493d92e893d7eae595544bcbe9cce1ce · Patch
• https://github.com/cvat-ai/cvat/security/advisories/GHSA-jpf9-646h-4px7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37306 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37306 · Vendor Advisory
• https://t.me/cvenotify/108016 · Telegram Post
• https://twitter.com/CVEnew/status/1801261032113148192 · Twitter Post