CVE-2023-5245

FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract(). Arbitrary file creation can directly lead to code execution

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/combust/mleap/pull/866#issuecomment-1738032225	Issue Tracking Patch
https://research.jfrog.com/vulnerabilities/mleap-path-traversal-rce-xray-532656/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:combust:mleap:0.18.0:::::::*
	cpe:2.3:a:combust:mleap:0.23.0:::::::*

History

No history.

Information

Published : 2023-11-15 13:15

Updated : 2023-11-22 22:39

NVD link : CVE-2023-5245

Mitre link : CVE-2023-5245

CVE.ORG link : CVE-2023-5245

JSON object : View

Products Affected

combust

mleap

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2023-5245", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "reefs@jfrog.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2023-11-15T13:15:07.457", "references": [{"url": "https://github.com/combust/mleap/pull/866#issuecomment-1738032225", "tags": ["Issue Tracking", "Patch"], "source": "reefs@jfrog.com"}, {"url": "https://research.jfrog.com/vulnerabilities/mleap-path-traversal-rce-xray-532656/", "tags": ["Exploit", "Third Party Advisory"], "source": "reefs@jfrog.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "reefs@jfrog.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory.\n\nWhen creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract().\n\nArbitrary file creation can directly lead to code execution\n\n"}, {"lang": "es", "value": "FileUtil.extract() enumera todas las entradas del archivo zip y extrae cada archivo sin validar si las rutas de los archivos en el archivo est\u00e1n fuera del directorio deseado. Al crear una instancia de TensorflowModel usando el formato save_model y un modelo de tensorflow exportado, la funci\u00f3n apply() invoca la implementaci\u00f3n vulnerable de FileUtil.extract(). La creaci\u00f3n arbitraria de archivos puede conducir directamente a la ejecuci\u00f3n del c\u00f3digo"}], "lastModified": "2023-11-22T22:39:07.763", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:combust:mleap:0.18.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84FDDCAB-F580-4036-BDF5-3EBC2C7D6CB7"}, {"criteria": "cpe:2.3:a:combust:mleap:0.23.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BBED8B0-FD39-44C2-A8E9-29734D62D3BA"}], "operator": "OR"}]}], "sourceIdentifier": "reefs@jfrog.com"}