CVE-2024-6578
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability in aimhubio/aim version 3.19.3 allows attackers to inject malicious scripts into terminal output logs. When users view the logs-tab, these scripts execute in their browser context, potentially stealing session cookies or performing unauthorized actions. This affects all users running the vulnerable version of aim.
💻 Affected Systems
- aimhubio/aim
📦 What is this software?
Aim by Aimstack
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain unauthorized access to the aim system, manipulate data, or redirect users to malicious sites.
Likely Case
Session hijacking, credential theft, or defacement of the logs interface through injected content.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though stored XSS remains a persistent threat.
🎯 Exploit Status
Exploitation requires the ability to inject malicious scripts into logs, which may depend on user privileges or other attack vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.19.4 or later
Vendor Advisory: https://huntr.com/bounties/5b1ebc67-5346-44aa-b8b8-3c1c09d79680
Restart Required: Yes
Instructions:
1. Update aim to version 3.19.4 or later using package manager (e.g., npm update aim). 2. Restart the aim application to apply the patch.
🔧 Temporary Workarounds
Disable logs-tab access
allTemporarily restrict access to the logs-tab interface to prevent exploitation.
Configure access controls in your web server or application firewall to block /logs-tab paths.
Implement Content Security Policy (CSP)
allAdd a CSP header to mitigate XSS by restricting script execution sources.
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to HTTP headers.
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all log inputs before storage.
- Use output encoding (e.g., HTML entity encoding) when displaying logs instead of dangerouslySetInnerHTML.
🔍 How to Verify
Check if Vulnerable:
Check if aim version is 3.19.3 by inspecting package.json or running 'npm list aim'.Check Version:
npm list aim | grep aimVerify Fix Applied:
Verify the aim version is 3.19.4 or later and test logs-tab functionality for script execution.📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript code in terminal output logs, unexpected log entries with HTML/script content.
Network Indicators:
- HTTP requests to external domains from the logs-tab page, anomalous traffic patterns to log endpoints.
SIEM Query:
source="aim_logs" AND (message="<script>" OR message="javascript:")