CVE-2024-3829
📋 TL;DR
CVE-2024-3829 is a path traversal vulnerability in qdrant/qdrant that allows attackers to read and write arbitrary files during snapshot recovery. By manipulating snapshot files to include symlinks, attackers can access sensitive system files or write malicious payloads. This affects qdrant/qdrant version 1.9.0-dev.
💻 Affected Systems
- qdrant/qdrant
📦 What is this software?
Qdrant by Qdrant
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary file write leading to remote code execution, credential theft, or data exfiltration.
Likely Case
Unauthorized access to sensitive files (configuration, credentials, data) and potential data manipulation.
If Mitigated
Limited impact if proper access controls and network segmentation are in place, but still significant risk to qdrant data.
🎯 Exploit Status
Exploit requires ability to upload or manipulate snapshot files, but no authentication is needed for the vulnerability itself. Public proof-of-concept exists in the bounty report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.9.0
Vendor Advisory: https://github.com/qdrant/qdrant/commit/ee7a31ec3459a6a4219200234615c1817ab82260
Restart Required: Yes
Instructions:
1. Stop qdrant service. 2. Update to version v1.9.0 or later using package manager or direct download. 3. Restart qdrant service. 4. Verify version is v1.9.0 or newer.
🔧 Temporary Workarounds
Disable snapshot recovery
allPrevent snapshot recovery functionality to block the attack vector
Configure qdrant to disable snapshot recovery via configuration file or environment variables
Restrict snapshot file access
linuxLimit who can upload or modify snapshot files
chmod 600 /path/to/snapshot/directory
chown root:root /path/to/snapshot/directory
🧯 If You Can't Patch
- Disable snapshot recovery functionality completely
- Implement strict access controls on snapshot directories and network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if running qdrant version 1.9.0-dev. If using snapshot recovery functionality, assume vulnerable.Check Version:
qdrant --version or check service/container versionVerify Fix Applied:
Verify qdrant version is v1.9.0 or newer and test snapshot recovery with controlled symlink files.📡 Detection & Monitoring
Log Indicators:
- Unusual snapshot recovery attempts
- Access to unexpected files during recovery
- Symlink creation in snapshot directories
Network Indicators:
- Unexpected snapshot uploads to qdrant API endpoints
SIEM Query:
source="qdrant" AND ("snapshot" AND "recovery") AND ("symlink" OR "../" OR path traversal patterns)