CVE-2024-5980: Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path traversal vulnerabilities. This can result in arbitrary files being written to any directory in the victim's local file system, potentially leading to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/lightningto a version that resolves this vulnerability.Fixed in 2.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5980?
CVE-2024-5980 is considered a high severity vulnerability due to the potential for path traversal attacks.
How do I fix CVE-2024-5980?
To fix CVE-2024-5980, upgrade the lightning-ai/pytorch-lightning package to version 2.3.3 or later.
What does CVE-2024-5980 affect?
CVE-2024-5980 affects the /v1/runs API endpoint of lightning-ai/pytorch-lightning version 2.2.4 and earlier.
What type of attack can CVE-2024-5980 facilitate?
CVE-2024-5980 can facilitate path traversal attacks by allowing attackers to extract malicious tar.gz files.
Is CVE-2024-5980 specific to certain server configurations?
Yes, CVE-2024-5980 is specifically exploitable when the LightningApp is running with the plugin_server.