PT-2024-30299 · Zenml · Zenml

Published 2024-11-14 · Updated 2024-11-18 · CVE-2024-4311

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.4

Description The issue is related to an account takeover due to the lack of rate-limiting in the password change function. An attacker can brute-force the current password in the 'Update Password' function, allowing them to take over the user's account. This is due to the absence of rate-limiting on the "/api/v1/current-user" endpoint, which does not restrict the number of attempts an attacker can make to guess the current password. Successful exploitation results in the attacker being able to change the password and take control of the account.

Recommendations For zenml-io/zenml version 0.56.4, consider implementing rate-limiting on the "/api/v1/current-user" endpoint to restrict the number of attempts an attacker can make to guess the current password. As a temporary workaround, consider restricting access to the 'Update Password' function until a patch is available.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-4311

GHSA-J3VQ-PMP5-R5XJ

Affected Products

Zenml

References · 7

• 🔥 https://huntr.com/bounties/d5517e1a-6b94-4e38-aad6-3aa65f98bec2 · Exploit
• https://github.com/zenml-io/zenml/commit/87a6c2c8f45b49ea83fbb5fe8fff7ab5365a60c9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-4311 · Security Note
• https://osv.dev/vulnerability/GHSA-j3vq-pmp5-r5xj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4311 · Vendor Advisory
• https://github.com/zenml-io/zenml · Note
• https://twitter.com/CVEnew/status/1857119161568084216 · Twitter Post