A vulnerability in the `LockManager.release_locks` function in aimhubio/aim (commit bb76afe) allows for arbitrary file deletion through relative path traversal. The `run_hash` parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. This vulnerability is exposed through the `Repo._close_run()` method, which is accessible via the tracking server instruction API. As a result, an attacker can exploit this to delete any arbitrary file on the machine running the tracking server.
The `run_hash` parameter, which is supplied by the user, is directly concatenated with the file path without prior normalization or validation. This allows an attacker to introduce path traversal sequences (e.g., `../../`) in order to exit the intended directory and point to any file in the file system. The vulnerable code path is accessible via the `Repo._close_run()` method, exposed by the tracking server instruction API. The attack requires no authentication or any user interaction.
An attacker can delete any file accessible to the tracking server process, which may lead to serious system disruptions, data loss, and even complete server failure by deleting critical configuration or system files.
Apply patches available from the vendor according to the references. It is recommended to restrict access to the tracking server API only to trusted hosts at the firewall level and to monitor suspicious file system operations.
Aimstack Aim (commit bb76afe); versions indicated in vendor references
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HAimstack Aim
APPAimstack< 3.24.0
Related vulnerabilities
CSRF w Aimstack Aim — łańcuch podatności z RCE i DoS
Path traversal w Aimstack Aim – zapis plików w dowolnej lokalizacji serwera
Nadpisywanie plików i RCE w Aimstack Aim przez funkcję _backup_run
RCE w Aimstack Aim – wykonanie kodu przez parametr query w API
Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the s...