// For flags

CVE-2024-5452

RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.

Existe una vulnerabilidad de ejecución remota de código (RCE) en la versión 2.2.1 de la librería Lightning-ai/pytorch-lightning debido al manejo inadecuado de la entrada del usuario deserializada y a la mala administración de los atributos dunder por parte de la librería "deepdiff". La librería utiliza objetos `deepdiff.Delta` para modificar el estado de la aplicación en función de las acciones del frontend. Sin embargo, es posible eludir las restricciones previstas sobre la modificación de los atributos de dunder, lo que permite a un atacante construir un delta serializado que pasa la lista blanca de deserializadores y contiene atributos de dunder. Cuando se procesa, esto se puede aprovechar para acceder a otros módulos, clases e instancias, lo que lleva a una escritura de atributos arbitraria y un RCE total en cualquier aplicación pytorch-lightning autohospedada en su configuración predeterminada, ya que el endpoint delta está habilitado de forma predeterminada.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-05-28 CVE Reserved
  • 2024-06-06 CVE Published
  • 2024-08-09 CVE Updated
  • 2024-11-22 First Exploit
  • 2025-02-16 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Lightning Ai
Search vendor "Lightning Ai"
 Lightning Ai/pytorch Lightning
Search vendor "Lightning Ai" for product "Lightning Ai/pytorch Lightning"
*-
Affected
Lightningai
Search vendor "Lightningai"
 Pytorch Lightning
Search vendor "Lightningai" for product "Pytorch Lightning"
*-
Affected