PT-2024-35355 · Giskard · Giskard

Kevinbackhouse · Published 2024-11-14 · Updated 2024-11-21 · CVE-2024-52524

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

Name of the Vulnerable Software and Affected Versions Giskard versions prior to 2.15.5

Description A Remote Code Execution (ReDoS) vulnerability was discovered in the Giskard component. This issue can trigger exponential regex evaluation times when processing datasets with specific text patterns, potentially leading to denial of service. The vulnerability affects Giskard's punctuation removal transformation used in the text perturbation detection, where a regex used to detect URLs and links is vulnerable to catastrophic backtracking.

Recommendations For Giskard versions prior to 2.15.5, upgrade to version 2.15.5 or later, which includes a fix for this vulnerability. As a temporary workaround, consider restricting the use of the text perturbation detection feature until the issue is resolved. Avoid using the vulnerable regex pattern in the text perturbation detector to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-52524

GHSA-PJWM-CR36-MWV3

Affected Products

Giskard

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52524.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-52524 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52524 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pjwm-cr36-mwv3 · Vendor Advisory
• https://github.com/Giskard-AI/giskard/security/advisories/GHSA-pjwm-cr36-mwv3 · Note
• https://github.com/Giskard-AI/giskard/commit/48ce81f5c626171767188d6f0669498fb613b4d3 · Note
• https://github.com/Giskard-AI/giskard · Note
• https://twitter.com/GHSecurityLab/status/1859668442040713461 · Twitter Post
• https://twitter.com/CVEnew/status/1857190675743490261 · Twitter Post
• https://t.me/cvedetector/10981 · Telegram Post