CVE-2023-30620
📋 TL;DR
CVE-2023-30620 is a path traversal vulnerability in mindsdb's tarball extraction that allows attackers to write files to arbitrary locations on the server. This affects all users running mindsdb versions before 23.2.1.0 who process remotely retrieved tarballs. The vulnerability enables file overwrites but not file disclosure.
💻 Affected Systems
- mindsdb
📦 What is this software?
Mindsdb by Mindsdb
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through overwriting critical system files, configuration files, or creating backdoors, potentially leading to remote code execution.
Likely Case
Service disruption through overwriting application files, configuration corruption, or denial of service by overwriting critical files.
If Mitigated
Limited impact if the server runs with minimal permissions, filesystem protections are in place, and only trusted tarballs are processed.
🎯 Exploit Status
Exploitation requires the ability to provide a malicious tarball to the mindsdb instance for processing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.2.1.0
Vendor Advisory: https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
Restart Required: Yes
Instructions:
1. Backup your mindsdb configuration and data. 2. Stop the mindsdb service. 3. Upgrade to version 23.2.1.0 or later using your package manager or pip. 4. Restart the mindsdb service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict mindsdb service account permissions to minimal required access.
- Implement strict input validation and only allow tarballs from trusted sources.
🔍 How to Verify
Check if Vulnerable:
Check mindsdb version: if version is less than 23.2.1.0, the system is vulnerable.Check Version:
mindsdb --version or pip show mindsdb | grep VersionVerify Fix Applied:
Verify mindsdb version is 23.2.1.0 or higher and check that the tarfile.extractall() usage has been replaced with secure extraction methods.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Errors from tar extraction with path traversal attempts
- Unexpected file modification timestamps in system directories
Network Indicators:
- Unusual tarball downloads to mindsdb instances
- Requests to mindsdb with malicious archive payloads
SIEM Query:
source="mindsdb.log" AND ("tarfile.extractall" OR "path traversal" OR "../")🔗 References
- https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039
- https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
- https://github.com/mindsdb/mindsdb/commit/4419b0f0019c000db390b54d8b9d06e1d3670039
- https://github.com/mindsdb/mindsdb/releases/tag/v23.2.1.0
- https://github.com/mindsdb/mindsdb/security/advisories/GHSA-2g5w-29q9-w6hx
