PT-2024-27928 · Qdrant · Qdrant

Published 2024-06-03 · Updated 2026-02-19 · CVE-2024-3829

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions qdrant/qdrant version 1.9.0-dev

Description The issue allows for arbitrary file read and write during the snapshot recovery process. Attackers can exploit this by manipulating snapshot files to include symlinks, leading to arbitrary file read by adding a symlink that points to a desired file on the filesystem and arbitrary file write by including a symlink and a payload file in the snapshot's directory structure. This could potentially lead to a full takeover of the system.

Recommendations For version 1.9.0-dev, update to version v1.9.0 to resolve the issue. As a temporary workaround, consider restricting access to the snapshot recovery process to minimize the risk of exploitation. Avoid using symlinks in snapshot files until the issue is resolved.

Exploit

Fix

RCE

Link Following

Weakness Enumeration

CWE-20

CWE-59

Related Identifiers

CVE-2024-3829

GHSA-7M75-X27W-R52R

Affected Products

Qdrant

References · 11

• 🔥 https://huntr.com/bounties/abd9c906-75ee-4d84-b76d-ce1386401e08 · Exploit
• https://github.com/qdrant/qdrant/commit/ee7a31ec3459a6a4219200234615c1817ab82260 · Patch
• https://osv.dev/vulnerability/GHSA-7m75-x27w-r52r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3829 · Security Note
• https://osv.dev/vulnerability/CVE-2024-3829 · Vendor Advisory
• https://github.com/qdrant/qdrant-client · Note
• https://t.me/cvenotify/128403 · Telegram Post
• https://t.me/cvenotify/81742 · Telegram Post
• https://twitter.com/AyushRijith/status/2024512795321201122 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1797621228997423403 · Twitter Post
• https://t.me/cveNotify/138729 · Telegram Post