CVE-2023-49796: GHSL-2023-182_GHSL-2023-184: Server-side request forgery (SSRF), arbitrary file write and limited file write vulnerabilities in mindsdb/mindsdb - CVE-2023-49795, CVE-2023-50731, CVE-2023-49796
Impact
The put method in mindsdb/mindsdb/api/http/namespaces/file.py does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. This issue may lead to arbitrary file write. This vulnerability allows for writing files anywhere on the server that the filesystem permissions that the running server has access to.
Patches
Use mindsdb staging branch or v23.11.4.1
References
GHSL-2023-184 See CodeQL path injection prevention guidelines and OWASP guidelines.
Other sources
MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in file.py Users should use MindsDB's staging branch or v23.11.4.1, which contain a fix for the issue.
— MITRE
Three vulnerabilities that can be exploited by unauthenticated users were found in MindsDB: a Server-side request forgery (SSRF) vulnerability, an arbitrary file write vulnerability and a limited file write vulnerability.
— GitHub Security Lab
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49796?
The severity of CVE-2023-49796 is considered high due to potential path injection vulnerabilities.
How do I fix CVE-2023-49796?
To fix CVE-2023-49796, upgrade the MindsDB package to version 23.11.4.1 or later.
Which versions of MindsDB are affected by CVE-2023-49796?
CVE-2023-49796 affects MindsDB versions prior to 23.11.4.1 and version 23.7.4.1.
What type of vulnerability is CVE-2023-49796?
CVE-2023-49796 is a path injection vulnerability due to improper validation of user input.
Where can I find more information about CVE-2023-49796?
For more information about CVE-2023-49796, refer to the MindsDB GitHub repository and their security advisories.