CVE-2024-37306
📋 TL;DR
This is a Cross-Site Request Forgery (CSRF) vulnerability in CVAT that allows attackers to trick authenticated users into performing unauthorized dataset exports or backups to cloud storage. Attackers can overwrite files in cloud storage accessible to the victim and potentially exfiltrate sensitive annotation data. Affects CVAT users with export permissions who visit malicious URLs.
💻 Affected Systems
- Computer Vision Annotation Tool (CVAT)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of cloud storage data integrity and confidentiality - attackers can overwrite critical files and exfiltrate sensitive annotation datasets, media files, and project configurations.
Likely Case
Data corruption in cloud storage and unauthorized access to annotation datasets, potentially exposing sensitive training data and intellectual property.
If Mitigated
Limited impact with proper CSRF protections and cloud storage access controls in place.
🎯 Exploit Status
Exploitation requires social engineering to trick authenticated users into visiting malicious URLs. No authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.14.3
Vendor Advisory: https://github.com/cvat-ai/cvat/security/advisories/GHSA-jpf9-646h-4px7
Restart Required: Yes
Instructions:
1. Backup your CVAT data and configurations. 2. Update CVAT to version 2.14.3 or later using your deployment method (Docker, Kubernetes, etc.). 3. Restart all CVAT services. 4. Verify the fix by checking the version and testing export functionality.
🔧 Temporary Workarounds
No official workarounds
allVendor states no known workarounds available
🧯 If You Can't Patch
- Implement strict cloud storage access controls and audit logging
- Educate users about phishing risks and implement URL filtering
🔍 How to Verify
Check if Vulnerable:
Check CVAT version: if between 2.2.0 and 2.14.2 inclusive, system is vulnerable.Check Version:
docker exec cvat_server python manage.py --versionVerify Fix Applied:
Verify CVAT version is 2.14.3 or later and test export functionality with CSRF protection enabled.📡 Detection & Monitoring
Log Indicators:
- Unexpected export/backup requests
- Export operations to unfamiliar cloud storage locations
- Multiple failed export attempts
Network Indicators:
- HTTP POST requests to /api/*/export endpoints without proper referrer headers
- Requests with suspicious origin headers
SIEM Query:
source="cvat" AND (event="export" OR event="backup") AND user_agent CONTAINS "malicious" OR referrer NOT IN allowed_domains🔗 References
- https://github.com/cvat-ai/cvat/commit/5d36d10e493d92e893d7eae595544bcbe9cce1ce
- https://github.com/cvat-ai/cvat/security/advisories/GHSA-jpf9-646h-4px7
- https://github.com/cvat-ai/cvat/commit/5d36d10e493d92e893d7eae595544bcbe9cce1ce
- https://github.com/cvat-ai/cvat/security/advisories/GHSA-jpf9-646h-4px7
