PT-2024-28627 · Bert-Vits · Bert-Vits

Sylwia Budzynska · Published 2024-07-22 · Updated 2024-09-11 · CVE-2024-39688

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bert-VITS2 versions 2.3 and earlier

Description The issue is related to the data dir variable, where user input is concatenated with other folders and used to open a new file in the generate config function, leading to a limited file write. This allows for writing a /config/config.json file in an arbitrary directory on the server. If a given directory path does not exist, the application will return an error, which could also be used to gain information about existing directories on the server.

Recommendations For versions 2.3 and earlier, consider restricting access to the generate config function until a patch is available. As a temporary workaround, avoid using the data dir variable in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-39688

Affected Products

Bert-Vits

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39688.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-045_GHSL-2024-047_fishaudio_Bert-VITS2 · Exploit
• https://osv.dev/vulnerability/CVE-2024-39688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39688 · Security Note
• https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L34 · Note
• https://github.com/fishaudio/Bert-VITS2/blob/76653b5b6d657143721df2ed6c5c246b4b1d9277/webui_preprocess.py#L130-L133 · Note
• https://t.me/cvedetector/1464 · Telegram Post
• https://t.me/cvenotify/94201 · Telegram Post