Arbitrary File/Directory Deletion in aimhubio/aim

Analysis

A vulnerability was discovered in the runs/delete-batch endpoint of aimhubio/aim version 3.19.3 [1][2]. The endpoint does not properly sanitize user-supplied run-names, which are used to specify log/metadata files for deletion. This lack of input validation enables path traversal attacks, allowing an attacker to specify directories or files outside the intended scope [2].

Exploitation

An attacker can exploit this by sending a crafted request to the runs/delete-batch endpoint with a run-name containing path traversal sequences (e.g., ../). No authentication is required, making the attack surface broad for any instance exposing this endpoint [2]. The endpoint directly uses the given path to delete files, bypassing any intended restrictions [2].

Impact

Successful exploitation allows arbitrary file or directory deletion on the server. This can lead to denial of service by removing critical application files or data loss by deleting user data or logs [2]. The impact is particularly severe for self-hosted Aim instances that are publicly accessible.

Mitigation

As of the publication date, no patch has been announced by the vendor. Users are advised to restrict network access to the Aim server and apply input validation or a web application firewall (WAF) rule to block path traversal patterns. The vendor has been notified through the Huntr bug bounty platform [3].