CVE-2024-7760

The Aim tracking server is configured with overly open CORS (Cross-Origin Resource Sharing) settings, which allows sending cross-origin requests from any domain. An attacker can trick a logged-in user into visiting a malicious website, which will send forged HTTP requests on their behalf to all endpoints of the tracking server. The CSRF vulnerability can then be chained with other existing flaws in the product, such as remote code execution (RCE), denial of service (DoS), and arbitrary file read and write.

An attacker can, through a victim, perform unauthorized operations on the tracking server, including potentially executing remote code (RCE), triggering denial of service (DoS), or reading and writing arbitrary files on the server — depending on which other vulnerabilities the CSRF is combined with.

Patches available from the vendor should be applied in accordance with the references. It is also recommended to restrict access to the tracking server exclusively to trusted networks and properly configure CORS policy to allow requests only from trusted domains.

Aimstack Aim version 3.22.0