PT-2025-12224 · Unknown+1 · Restrictedpython+1

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8238

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.22.0

Description The AimQL query language in aimhubio/aim uses an outdated version of the safer getattr() function from RestrictedPython, which does not protect against the str.format map() method. This allows an attacker to leak server-side secrets or potentially gain unrestricted code execution by reading arbitrary attributes of Python objects, including sensitive variables such as os.environ. If an attacker can write files to a known location on the Aim server, they can use str.format map() to load a malicious .dll/.so file into the Python interpreter, leading to unrestricted code execution.

Recommendations For version 3.22.0, consider updating the safer getattr() function from RestrictedPython to a version that protects against the str.format map() method to prevent potential code execution and sensitive data leakage. As a temporary workaround, restrict access to sensitive variables and limit the ability to write files to known locations on the Aim server.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-1336

Related Identifiers

CVE-2024-8238

GHSA-R229-5WGF-F28G

Affected Products

Restrictedpython

Aim

References · 7

• 🔥 https://huntr.com/bounties/4e140ef9-f6d1-4e68-a44c-3b9e856924d3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8238 · Security Note
• https://osv.dev/vulnerability/GHSA-r229-5wgf-f28g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8238 · Vendor Advisory
• https://github.com/aimhubio/aim · Note
• https://github.com/aimhubio/aim/blob/main/aim/storage/query.py#L45 · Note
• https://twitter.com/CVEnew/status/1902671017362776362 · Twitter Post