PT-2024-31195 · Zenml Io · Zenml

Published 2024-06-24 · Updated 2024-07-17 · CVE-2024-4460

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions zenml-io/zenml version 0.56.3

Description A denial of service issue exists due to improper handling of line feed ( ) characters in component names. When a low-privileged user adds a component through the API endpoint api/v1/workspaces/default/components with a name containing a character, it leads to uncontrolled resource consumption. This results in the inability of users to add new components in certain categories and to register new stacks through the UI, degrading the user experience and potentially rendering the ZenML Dashboard unusable. The issue does not affect component addition through the Web UI, as characters are properly escaped in that context.

Recommendations For zenml-io/zenml version 0.56.3, as a temporary workaround, consider restricting access to the api/v1/workspaces/default/components API endpoint to prevent low-privileged users from adding components with names containing characters until a patch is available. Avoid using the name parameter in the affected API endpoint with values containing characters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-4460

GHSA-7GJR-HCC3-XFR4

Affected Products

Zenml

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-4460 · Security Note
• https://osv.dev/vulnerability/GHSA-7gjr-hcc3-xfr4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4460 · Vendor Advisory
• https://github.com/zenml-io/zenml · Note
• https://github.com/zenml-io/zenml/commit/164cc09032060bbfc17e9dbd62c13efd5ff5771b · Note
• https://t.me/cvenotify/84153 · Telegram Post
• https://huntr.com/bounties/a387c935-b970-44d7-bddc-71c1c90aa2de · Note