Denial of Service in aimhubio/aim

Vulnerability

Description CVE-2024-8061 affects aimhubio/aim version 3.23.0. Certain methods that communicate with external servers, such as _run_read_instructions in the tracking server's client, do not set timeouts [2][3]. This causes the server to wait indefinitely for a response, preventing it from handling other requests.

Exploitation

An attacker can exploit this by controlling or manipulating an external resource that the aim server contacts. By making the external resource slow or unresponsive, the server becomes blocked, leading to a denial of service. The attack does not require authentication if the server is configured to reach untrusted external services [2].

Impact

Successful exploitation results in a denial of service, as the tracking server becomes unresponsive to legitimate client requests. This can disrupt machine learning experiment tracking and halt operations [2].

Mitigation

As of the publication date, no patch has been released. Users should update to a fixed version when available or implement timeouts for external requests, as seen in the source code [3]. The vulnerability is listed on Huntr [4] and tracked in the GitHub repository [1].