Path Traversal in Linuxfoundation Onnx
CVE-2024-5187
A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.012 (64.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Linuxfoundation Onnx — versions 1.16.0
- Onnx Onnx/onnx — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2024-5187?
- CVE-2024-5187 is a high-severity vulnerability in Linuxfoundation Onnx, classified under Path Traversal. CVSS score: 8.8/10. Published 2024-06-06.
- How severe is CVE-2024-5187?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-5187 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.