PT-2024-37120 · Flask+1 · Flask+1

Published 2024-07-05 · Updated 2024-07-08 · CVE-2024-5753

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: vanna-ai/vanna version v0.3.4

Description: The issue allows unauthenticated remote users to read arbitrary local files on the victim server, including sensitive files like /etc/passwd, by exploiting exposed SQL queries via a Python Flask API. This is made possible through SQL injection in some file-critical functions such as pg read file().

Recommendations: For version v0.3.4, consider disabling the pg read file() function until a patch is available to prevent exploitation of the SQL injection vulnerability. Restrict access to sensitive files and ensure proper input validation and sanitization in the Python Flask API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200

CWE-89

Related Identifiers

CVE-2024-5753

GHSA-MWXM-35F8-6VG2

Affected Products

Flask

Vanna

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-5753 · Security Note
• https://osv.dev/vulnerability/GHSA-mwxm-35f8-6vg2 · Vendor Advisory
• https://github.com/vanna-ai/vanna · Note
• https://twitter.com/CVEnew/status/1809310476615999693 · Twitter Post
• https://huntr.com/bounties/a3f913d6-c717-4528-b974-26d8d9e839ca · Note
• https://t.me/cvedetector/136 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1809357883227701632 · Twitter Post
• https://t.me/cvenotify/85288 · Telegram Post