PT-2024-31985 · Wandb · Wandb

Published 2024-05-16 · Updated 2024-05-16 · CVE-2024-4642

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions wandb (affected versions not specified)

Description A Server-Side Request Forgery (SSRF) issue exists due to improper handling of HTTP 302 redirects. This allows team members with access to the 'User settings -> Webhooks' function to exploit the issue and access internal HTTP(s) servers. In severe cases, such as on AWS instances, this could potentially be abused to achieve remote code execution on the victim's machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-4642

GHSA-CQH9-JFQR-H9JJ

Affected Products

Wandb

References · 5

• https://osv.dev/vulnerability/GHSA-cqh9-jfqr-h9jj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4642 · Security Note
• https://github.com/wandb/wandb · Note
• https://github.com/wandb/wandb/blob/main/wandb/sdk/lib/import_hooks.py#L1 · Note
• https://huntr.com/bounties/055eb540-57f8-46d6-b858-3a9e22d347d9 · Note