CVE-2024-6396 in the critical feed json
Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
published 2y ago modified 4mo ago also EUVD-2024-47502
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.1%
- EPSS 53.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
Is CVE-2024-6396 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2y ago
Exploit prediction
53.11% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- huntr.com https://huntr.com/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- aimhubio aimhubio/aim
- aimhubio aim
Classification
- Weakness
-
- CWE-29 Path Traversal: '\..\filename'
References
-
huntr.com
/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0
exploit, third-party-advisory
Sources
- CVE List CVE-2024-6396
- NVD CVE-2024-6396
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.