CVE-2024-7760
📋 TL;DR
Aim version 3.22.0 has overly permissive CORS settings that allow cross-origin requests from any domain, enabling CSRF attacks on all tracking server endpoints. This vulnerability can be chained with existing RCE, DoS, and file read/write vulnerabilities. Anyone running Aim 3.22.0 tracking server is affected.
💻 Affected Systems
- aimhubio/aim
📦 What is this software?
Aim by Aimstack
⚠️ Risk & Real-World Impact
Worst Case
Attackers chain CSRF with RCE to gain full system control, execute arbitrary code, read/write sensitive files, and cause denial of service.
Likely Case
Attackers perform unauthorized actions via CSRF, potentially leading to data manipulation, privilege escalation, or service disruption.
If Mitigated
With proper CORS restrictions and CSRF protections, impact is limited to attempted attacks that fail due to validation.
🎯 Exploit Status
CSRF exploitation is straightforward; chaining with other vulnerabilities requires additional steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.22.1 or later
Vendor Advisory: https://huntr.com/bounties/2038df5f-4829-4040-8573-67bf9bb89229
Restart Required: Yes
Instructions:
1. Update Aim to version 3.22.1 or later using pip: pip install --upgrade aim==3.22.1
2. Restart the Aim tracking server
3. Verify the fix by checking CORS headers in server responses
🔧 Temporary Workarounds
Restrict CORS Origins
allConfigure Aim server to only allow specific trusted origins instead of all origins
Modify Aim configuration to set allowed_origins to specific domains
Implement CSRF Tokens
allAdd CSRF token validation to all endpoints
Implement CSRF middleware or token validation in Aim server code
🧯 If You Can't Patch
- Isolate Aim server behind firewall with strict access controls
- Implement reverse proxy with proper CORS and CSRF protections
🔍 How to Verify
Check if Vulnerable:
Check if Aim server responds with Access-Control-Allow-Origin: * header to cross-origin requestsCheck Version:
pip show aim | grep VersionVerify Fix Applied:
Verify Access-Control-Allow-Origin header is restricted to specific origins or not present📡 Detection & Monitoring
Log Indicators:
- Unusual cross-origin requests
- Failed CSRF token validations
- Unexpected endpoint access patterns
Network Indicators:
- Requests with Origin headers to Aim endpoints
- Cross-origin POST/PUT/DELETE requests
SIEM Query:
source="aim_server" AND (http_header="Origin" OR http_method IN ("POST", "PUT", "DELETE"))