CVE-2024-8019: Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning
In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to potential remote code execution (RCE) by overwriting critical files or placing malicious files in sensitive locations.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8019?
CVE-2024-8019 has been classified as a high-severity vulnerability due to its potential impact on file system integrity.
How do I fix CVE-2024-8019?
To remediate CVE-2024-8019, upgrade to version 2.4.0 or later of the PyTorch Lightning package.
What products are affected by CVE-2024-8019?
CVE-2024-8019 affects the PyTorch Lightning package, specifically version 2.3.2 when used on Windows hosts.
What type of attack does CVE-2024-8019 allow?
CVE-2024-8019 allows an attacker to write or overwrite arbitrary files via a crafted filename at the /api/v1/upload_file/ endpoint.
Is CVE-2024-8019 specific to any operating system?
Yes, CVE-2024-8019 specifically affects installations running on Windows operating systems.