A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnerability by manipulating the 'logs' URI path in the request to fetch arbitrary file content, bypassing intended access restrictions. The vulnerability arises due to the lack of validation for directory traversal patterns, allowing attackers to access files outside of the restricted directory.
An attacker with basic privileges (authenticated user) can manipulate the 'logs' parameter in the URI path of a request directed to the /api/v1/steps endpoint. The lack of validation for traversal patterns in this parameter allows exiting the intended directory and reading arbitrary operating system files. As a result, it is possible to bypass the intended access control mechanisms without any additional user interaction.
An attacker can gain access to arbitrary files on the server's file system, including configuration files, secrets, private keys, or data of other users, leading to a breach of confidentiality and potentially compromising the integrity and availability of the system. Due to the changed scope (S:C), the impact may extend beyond the directly attacked component.
ZenML should be updated to a version containing the fix commit 00e934f33a243a554f5f65b80eefd5ea5117367b available in the GitHub repository. Detailed information about the patch version is available at https://github.com/zenml-io/zenml/commit/00e934f33a243a554f5f65b80eefd5ea5117367b and https://huntr.com/bounties/f24b2216-6a4b-42a1-becb-9b47e6cf117f
ZenML (zenml-io/zenml) – versions indicated in the vendor references (fix commit: 00e934f33a243a554f5f65b80eefd5ea5117367b)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HZenml
APPZenml< 0.55.5
Related vulnerabilities
ZenML version 0.83.1 is affected by a path traversal vulnerability in the `PathMaterializer` class. The `load`...
A Denial of Service (DoS) vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to c...
A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session ...
zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materi...
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation...