Executive brief
Aim is an open-source experiment tracking platform used by data scientists and ML engineers to log and manage model training runs. A vulnerability allows attackers to configure the remote tracking server to point at itself, causing an infinite loop that exhausts server resources and makes it unable to serve legitimate requests.
Technical details
The vulnerability is an infinite loop (CWE-835) in the remote tracking server configuration logic. An attacker can configure the remote tracking server endpoint to point back to itself, causing the server to repeatedly connect to itself in an endless cycle. This requires network access to the server's configuration interface; no authentication bypass is demonstrated. The attack results in a denial of service as the server becomes unresponsive to other connections. The vulnerable code is located in aim/sdk/repo.py at line 195.
Affected products
- aimhubio Aim 0–3.19.3
Timeline
- 2024-07-08: disclosed
- 2024-08-07: advisory: GitHub reviewed