Vulnerability Description
A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linuxfoundation | Onnx | 1.16.0 |
Related Weaknesses (CWE)
References
- https://huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237eExploitIssue TrackingThird Party Advisory
- https://huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237eExploitIssue TrackingThird Party Advisory
FAQ
What is CVE-2024-5187?
CVE-2024-5187 is a vulnerability with a CVSS score of 8.8 (HIGH). A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks i...
How severe is CVE-2024-5187?
CVE-2024-5187 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-5187?
Check the references section above for vendor advisories and patch information. Affected products include: Linuxfoundation Onnx.