HomeVulnerabilityLightning AI Studio Vulnerability Allowed RCE through Hidden URL Parameter

Lightning AI Studio Vulnerability Allowed RCE through Hidden URL Parameter

Cybersecurity researchers have disclosed a vital security flaw within the Lightning AI Studio improvement platform that, if efficiently exploited, may enable for distant code execution.

The vulnerability, rated a CVSS rating of 9.4, permits “attackers to probably execute arbitrary instructions with root privileges” by exploiting a hidden URL parameter, utility security agency Noma stated in a report shared with The Hacker Information.

“This degree of entry may hypothetically be leveraged for a variety of malicious actions, together with the extraction of delicate keys from focused accounts,” researchers Sasi Levi, Alon Tron, and Gal Moyal stated.

The difficulty is embedded in a bit of JavaScript code that might facilitate unfettered entry to a sufferer’s improvement setting, in addition to run arbitrary instructions on an authenticated goal in a privileged context.

Noma stated it discovered a hidden parameter known as “command” in user-specific URLs – e.g., “lightning.ai/PROFILE_USERNAME/vision-model/studios/STUDIO_PATH/terminal?fullScreen=true&commmand=cmVzc…” – which might be used to move a Base64-encoded instruction to be executed on the underlying host.

Cybersecurity

Even worse, the loophole might be weaponized to run instructions that may exfiltrate vital info akin to entry tokens and person info to an attacker-controlled server.

See also  U.S. Sanctions 6 Iranian Officers for Essential Infrastructure Cyber Attacks

Profitable exploitation of the vulnerability implies that it may allow an adversary to execute arbitrary privileged instructions and acquire root entry, harvest delicate information, and manipulate the file system to create, delete, or modify information on the server.

Lightning AI Studio Vulnerability

All an attacker wants to tug this off is prior data of a profile username and their related Lightning AI Studio, particulars which might be publicly obtainable through the Studio templates gallery.

Armed with this info, the risk actor can then craft a malicious hyperlink such that it triggers code execution on the recognized Studio underneath root permissions. Following accountable disclosure on October 14, 2024, the issue has been resolved by the Lightning AI crew as of October 25.

“Vulnerabilities like these underscore the significance of mapping and securing the instruments and programs used for constructing, coaching, and deploying AI fashions due to their delicate nature,” the researchers stated.

- Advertisment -spot_img
RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

- Advertisment -

Most Popular