CVE-2021-43775
📋 TL;DR
CVE-2021-43775 is a path traversal vulnerability in Aim, an open-source machine learning experiment tracking tool. Attackers can use directory traversal sequences like '../' to access arbitrary files on the server, including sensitive configuration files and system files. This affects all Aim installations prior to version 3.1.0.
💻 Affected Systems
- Aim
📦 What is this software?
Aim by Aimstack
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through access to sensitive files like SSH keys, database credentials, or system configuration files, potentially leading to data theft, privilege escalation, or full system takeover.
Likely Case
Exfiltration of sensitive application data, configuration files, or source code, which could enable further attacks or intellectual property theft.
If Mitigated
Limited impact if proper file permissions and network segmentation are in place, potentially restricting access to non-critical files only.
🎯 Exploit Status
The vulnerability is in the file serving API endpoint and requires no authentication. Exploitation is straightforward using standard path traversal techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.0
Vendor Advisory: https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc
Restart Required: Yes
Instructions:
1. Stop the Aim service. 2. Update Aim to version 3.1.0 or later using pip: 'pip install aim>=3.1.0'. 3. Restart the Aim service.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Aim instances to trusted IP addresses only
Use firewall rules to limit access: iptables -A INPUT -p tcp --dport 43800 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 43800 -j DROP
File Permission Hardening
linuxSet strict file permissions on sensitive directories to limit potential damage
chmod 700 /etc/
chmod 700 /root/
chmod 700 ~/.ssh/
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Aim instances from sensitive systems
- Deploy a web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check Aim version: 'aim version' or 'pip show aim' and verify if version is below 3.1.0Check Version:
aim versionVerify Fix Applied:
Confirm version is 3.1.0 or higher: 'aim version' should show 3.1.0+📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in Aim logs
- Requests containing '../' sequences in URL parameters
- Access to files outside expected Aim directories
Network Indicators:
- HTTP requests with path traversal sequences to Aim API endpoints
- Unusual outbound data transfers from Aim servers
SIEM Query:
source="aim.log" AND ("../" OR "..\" OR "%2e%2e%2f" OR "%2e%2e%5c")🔗 References
- https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16
- https://github.com/aimhubio/aim/issues/999
- https://github.com/aimhubio/aim/pull/1003
- https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738
- https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc
- https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16
- https://github.com/aimhubio/aim/issues/999
- https://github.com/aimhubio/aim/pull/1003
- https://github.com/aimhubio/aim/pull/1003/commits/f01266a1a479ef11d7d6c539e7dd89e9d5639738
- https://github.com/aimhubio/aim/security/advisories/GHSA-8phj-f9w2-cjcc
