CVE-2024-8019
📋 TL;DR
This vulnerability in PyTorch Lightning's LightningApp allows attackers to write arbitrary files via a crafted filename at the /api/v1/upload_file/ endpoint on Windows hosts. This can lead to remote code execution by overwriting critical files or placing malicious executables. Users running PyTorch Lightning 2.3.2 on Windows with LightningApp exposed are affected.
💻 Affected Systems
- lightning-ai/pytorch-lightning
📦 What is this software?
Pytorch Lightning by Lightningai
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
File system corruption, service disruption, or limited code execution depending on attacker's file placement.
If Mitigated
Denial of service through file overwrites if critical files are protected but writable locations exist.
🎯 Exploit Status
Simple HTTP POST request with crafted filename parameter. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.3 or later
Vendor Advisory: https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a
Restart Required: Yes
Instructions:
1. Update PyTorch Lightning: pip install --upgrade pytorch-lightning>=2.3.3
2. Restart any running LightningApp instances
3. Verify version with: python -c "import pytorch_lightning; print(pytorch_lightning.__version__)"
🔧 Temporary Workarounds
Disable vulnerable endpoint
allRemove or block access to /api/v1/upload_file/ endpoint
# Configure web server (nginx example)
location /api/v1/upload_file/ { return 403; }
# Application-level disable if configurable
Migrate to Linux/macOS
allDeploy LightningApp on non-Windows operating systems
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to LightningApp API endpoints
- Deploy web application firewall (WAF) with file upload protection and path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check if running PyTorch Lightning 2.3.2 on Windows with LightningApp accessibleCheck Version:
python -c "import pytorch_lightning; print(pytorch_lightning.__version__)"Verify Fix Applied:
Confirm version is 2.3.3+ and test file upload endpoint with path traversal attempts📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /api/v1/upload_file/ with suspicious filenames containing ../ or absolute paths
- File creation/modification in unexpected system locations
Network Indicators:
- Unusual file upload patterns to the API endpoint
- Multiple failed upload attempts with path traversal patterns
SIEM Query:
source="web_logs" AND uri_path="/api/v1/upload_file/" AND (filename="*../*" OR filename="*:*" OR filename="*\\*" OR filename="*/*")