=====================================================================

                             CERT-Renater

                  Note d'Information No. 2021/VULN623
_____________________________________________________________________


DATE                : 24/11/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running aim (pip) versions prior to 3.1.0.

=====================================================================
https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc
_____________________________________________________________________

Arbitrary file reading vulnerability

high
gorarakelyan published GHSA-8phj-f9w2-cjcc Nov 23, 2021


Package
aim (pip)

Affected versions
<=3.0.6

Patched versions
3.1.0


Description

Impact

A path traversal attack aims to access files and directories that are
stored outside the web root folder. By manipulating variables that
reference files with “dot-dot-slash (../)” sequences and its variations
or by using absolute file paths, it may be possible to access arbitrary
files and directories stored on file system including application source
code or configuration and critical system files.


Vulnerable code:

aim/aim/web/api/views.py

Lines 9 to 16 in 0b99c6c
   @statics_router.get('/static-files/{path:path}/')
   async def serve_static_files(path):
       from aim import web
       static_file_name = os.path.join(os.path.dirname(web.__file__), 
'ui', 'build', path)
       compressed_file_name = '{}.gz'.format(static_file_name)
       if os.path.exists(compressed_file_name):
           return FileResponse(compressed_file_name, 
headers={'Content-Encoding': 'gzip'})
       return FileResponse(static_file_name)


Patches

The vulnerability issue is resolved in Aim v3.1.0.


References

https://owasp.org/www-community/attacks/Path_Traversal


CVE ID
CVE-2021-43775

CWEs
CWE-73

Credits

      @haby0 haby0 haby0


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================