CVE-2024-12216
📋 TL;DR
This vulnerability in the gluon-cv library allows attackers to overwrite arbitrary files on a victim's system through a TarSlip attack. When the ImageClassificationDataset.from_csv() API processes malicious tar.gz files, it extracts them without proper path sanitization, enabling path traversal. Users of gluon-cv version 0.10.0 who process untrusted CSV files with URLs pointing to tar archives are affected.
💻 Affected Systems
- dmlc/gluon-cv
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via overwriting critical system files like /etc/passwd, /etc/shadow, or SSH keys, potentially leading to remote code execution or privilege escalation.
Likely Case
Data corruption, denial of service, or limited file overwrite in the application's context directory, potentially affecting other applications or user data.
If Mitigated
If proper input validation and sandboxing are in place, exploitation would be limited to the application's isolated environment with minimal impact.
🎯 Exploit Status
Exploitation requires the victim to process a malicious CSV file containing crafted tar.gz URLs. The attacker needs to control the tar archive content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.10.1 or later
Vendor Advisory: https://github.com/dmlc/gluon-cv/security/advisories/GHSA-xxxx-xxxx-xxxx
Restart Required: No
Instructions:
1. Update gluon-cv using pip: pip install --upgrade gluon-cv>=0.10.1
2. Verify the installed version with: pip show gluon-cv
3. No application restart required as this is a library update.
🔧 Temporary Workarounds
Input validation and sanitization
allValidate and sanitize all URLs in CSV files before passing to ImageClassificationDataset.from_csv(). Only allow URLs from trusted sources.
Sandbox extraction
allExtract tar files in a temporary, isolated directory with restricted permissions before processing.
🧯 If You Can't Patch
- Disable or avoid using ImageClassificationDataset.from_csv() with untrusted CSV files or URLs.
- Implement strict input validation to only process tar.gz files from trusted, whitelisted sources.
🔍 How to Verify
Check if Vulnerable:
Check if gluon-cv version is 0.10.0: pip show gluon-cv | grep VersionCheck Version:
pip show gluon-cv | grep VersionVerify Fix Applied:
Verify gluon-cv version is 0.10.1 or later: pip show gluon-cv | grep Version📡 Detection & Monitoring
Log Indicators:
- Failed file write attempts outside expected directories
- Unexpected tar extraction errors
- CSV processing errors with malformed URLs
Network Indicators:
- Downloads of tar.gz files from untrusted sources during CSV processing
SIEM Query:
Search for process executions of gluon-cv with CSV file arguments, combined with file system writes outside application directories.