CVE-2024-6396 in the critical feed json
Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim
published 2024-07-12 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-47502
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.1%
- EPSS 53.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
53.11% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite nuclei detection template
- huntr.com https://huntr.com/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- aimhubio aimhubio/aim
- aimhubio aim
Classification
- Weakness
-
- CWE-29 Path Traversal: '\..\filename'
References
-
huntr.com
/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0
exploit, third-party-advisory
Sources
- CVE List CVE-2024-6396
- NVD CVE-2024-6396
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.