CVE-2024-25723

ZenML Server allows remote privilege escalation via an insecure API endpoint.

• CVSS 8.8
• CWE-284
• Authentication, Authorization, and Session Management
• Remote

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.

CVE

CVE-2024-25723

CWE

CWE-284

CVSS base score

8.8

Published

2024-02-27

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Privilege Escalation

Affected component

ZenML

Fixed by upgrading

Yes

Solution

Upgrade to ZenML version 0.46.7 or later.

from flask import Flask, request, jsonify

app = Flask(__name__)

users = {
    "user1": {"password": "old_password", "active": False},
}

@app.route('/api/v1/users/<username>/activate', methods=['POST'])
def activate_user(username):
    if username not in users:
        return jsonify({"error": "User  not found"}), 404

    data = request.json
    new_password = data.get('new_password')

    if new_password:
        users[username]['active'] = True
        return jsonify({"message": "User  activated successfully."}), 200

    return jsonify({"error": "New password required"}), 400

if __name__ == '__main__':
    app.run()

from flask import Flask, request, jsonify, abort

app = Flask(__name__)

users = {
    "user1": {"password": "old_password", "active": False},
}

@app.route('/api/v1/users/<username>/activate', methods=['POST'])
def activate_user(username):
    if username not in users:
        abort(404)

    data = request.json
    new_password = data.get('new_password')

    if not is_user_authorized(username):
        abort(403)

    if users[username]['password'] == new_password:
        users[username]['active'] = True
        return jsonify({"message": "User  activated successfully."}), 200
    else:
        abort(401)

def is_user_authorized(username):
    return True

if __name__ == '__main__':
    app.run()

{
    "new_password": "new_password_value"
}

@misc{vaitp:cve202425723,
  title        = {{ZenML Server allows remote privilege escalation via an insecure API endpoint.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-25723},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-25723/}}
}