Improper Input Validation in mindsdb
Medium5.3CVE-2023-49796 · Published Dec 12, 2023 · updated Nov 22, 2024
### Impact The put method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled `name` value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. This issue may lead to arbitrary file write. This vulnerability allows for writing files anywhere on the server that the filesystem permissions that the running server has access to. ### Patches Use mindsdb staging branch or v23.11.4.1 ### References * GHSL-2023-184 * See [CodeQL path injection prevention guidelines](https://codeql.github.com/codeql-query-help/python/py-path-injection/) and [OWASP guidelines](https://owasp.org/www-community/attacks/Path_Traversal).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mindsdb PyPI | < 23.11.4.1 | 23.11.4.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20
- Also known as
- CVE-2023-49796
- github.com/mindsdb/mindsdb/security/advisories/GHSA-crhp-7c74-cg4c
- nvd.nist.gov/vuln/detail/CVE-2023-49796
- github.com/mindsdb/mindsdb/commit/8d13c9c28ebcf3b36509eb679378004d4648d8fe
- github.com/mindsdb/mindsdb
- github.com/mindsdb/mindsdb/blob/1821da719f34c022890c9ff25810218e71c5abbc/mindsdb/api/http/namespaces/file.py#L122-L125
- github.com/pypa/advisory-database/tree/main/vulns/mindsdb/PYSEC-2023-278.yaml
More MindsDB advisories
All MindsDB| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 162024 | Cross-site Scripting (XSS) in mindsdb/mindsdb Medium5.8Apr 16, 2024 | Medium5.8 | No fix yet |
| Dec 152023 | GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182High9.1Dec 15, 2023 | High9.1 | 23.11.4.1 |
| Dec 122023 | Server-Side Request Forgery in mindsdbMedium6.5Dec 12, 2023 | Medium6.5 | 23.11.4.1 |
| Aug 12023 | MindsDB can be made to not verify SSL certificatesCritical9.1Aug 1, 2023 | Critical9.1 | 23.7.4.0 |
| Mar 302023 | mindsdb arbitrary file write when extracting a remotely retrieved TarballHigh7.5Mar 30, 2023 | High7.5 | 23.2.1.0 |
| Mar 302023 | Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote locationMedium8.5Mar 30, 2023 | Medium8.5 | 22.11.4.3 |