Stored XSS in aimhubio/aim

Vulnerability

Description CVE-2024-6578 is a stored cross-site scripting (XSS) vulnerability in aimhubio/aim version 3.19.3. The root cause is improper neutralization of user input when generating web pages, specifically within the logs-tab for runs. The terminal output logs are rendered using React's dangerouslySetInnerHTML function, which bypasses React's default XSS protections and directly inserts raw HTML into the DOM [2]. This design flaw allows any attacker who can supply log content to introduce arbitrary script elements.

Exploitation

Prerequisites An attacker must be able to inject malicious content into the logs that are later displayed in the logs-tab. This could occur if the attacker has the ability to submit log data (e.g., through a compromised training script, or by exploiting another input vector that feeds into the logs). No additional authentication is required for the execution of the XSS payload, as the vulnerability triggers when any user views the affected logs-tab [1]. The attack does not require a specific network position—any user accessing the Aim UI can be targeted.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the browser of any user who views the logs-tab containing the injected script. This can result in session hijacking, data exfiltration, or further malicious actions within the context of the afflicted Aim instance. The stored (persistent) nature of the XSS means the payload remains until the log entry is removed, affecting all subsequent viewers [2].

Mitigation

As of the publication date (2024-07-29), no patch has been announced for this vulnerability. Users of Aim 3.19.3 are advised to avoid viewing untrusted logs in the UI until a fix is released. The project maintainers were notified via the Huntr bug bounty platform [3], and the vulnerability has a reserved CVE identifier. It is recommended to migrate to a patched version when available, or apply mitigations such as input sanitization and disabling dangerouslySetInnerHTML on user-supplied content.