CSRF Vulnerability in aimhubio/aim

Vulnerability

CVE-2024-2196 describes a Cross-Site Request Forgery (CSRF) vulnerability in aimhubio/aim, an open-source ML experiment tracker. The aim dashboard fails to implement CSRF tokens and has insufficient CORS protections, enabling an attacker to craft malicious requests that appear legitimate to the server [1][2].

Exploitation

To exploit this, an attacker must trick an authenticated user into visiting a malicious webpage or clicking a crafted link. The malicious script then sends unauthorized requests to the aim server, leveraging the user's active session. No additional authentication is required beyond the user's existing session [2][3].

Impact

An attacker can delete experiment runs, modify metadata (e.g., notes, tags), and exfiltrate sensitive data such as log records and training metrics. This could lead to significant data loss and compromise the integrity of ML experiments [2][3].

Mitigation

As of the publication date, no patch has been announced by the vendor. Users should apply workarounds such as disabling cross-origin requests or using browser extensions for CSRF protection. The aim project may need to implement server-side CSRF tokens and enforce CORS policies [1][2].