A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the host server. The attacker can control `repo.path` and `run_hash` to bypass directory existence checks and extract files to unintended locations, potentially overwriting critical files. This can lead to arbitrary data being written to arbitrary locations on the remote tracking server, which could be used for further attacks such as writing a new SSH key to the target server.
The attacker controls the `repo.path` and `run_hash` parameters, which allows him to bypass directory existence check mechanisms. Subsequently, the `tarfile.extractall()` function is called on a crafted tar archive, which through a path traversal technique directs extracted files outside the intended target directory. As a result, it is possible to write arbitrary data to any locations in the server's file system – for example, overwriting authorized SSH keys.
An attacker can write or overwrite arbitrary files on the server, including critical system and configuration files, which may enable persistent unauthorized access to the server (e.g., through SSH key injection).
Apply patches available from the vendor according to references (https://huntr.com/bounties/7c97065c-1b63-4982-82c1-8038be0ed570). Until updated, it is recommended to restrict network access to the tracking server and monitor attempts to write files outside authorized directories.
Aimstack Aim version 3.19.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HAimstack Aim
APPAimstack3.19.3
Related vulnerabilities
Aimstack Aim: path traversal umożliwiający usunięcie dowolnego pliku
CSRF w Aimstack Aim — łańcuch podatności z RCE i DoS
Nadpisywanie plików i RCE w Aimstack Aim przez funkcję _backup_run
RCE w Aimstack Aim – wykonanie kodu przez parametr query w API
Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the s...