Vulnerability record · CVE-2024-6396 · published 12 July 2024
CVE-2024-6396: Aim _backup_run path traversal allows arbitrary file overwrite
Aimstack · Aim
Aim 3.19.3 mishandles the run_hash and repo.path parameters in the _backup_run function, letting a remote attacker build arbitrary file paths and write to them. This permits overwriting any file on the host, which can destroy data, expose private data, or lead to remote code execution.
Description
A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the `run_hash` and `repo.path` parameters, which can be manipulated to create and write to arbitrary file paths. This can lead to denial of service by overwriting critical system files, loss of private data, and potential remote code execution.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or interaction required, high EPSS, and public exploit references make this an urgent remote file overwrite risk.
What it is
Aim 3.19.3 mishandles the run_hash and repo.path parameters in the _backup_run function, letting a remote attacker build arbitrary file paths and write to them. This permits overwriting any file on the host, which can destroy data, expose private data, or lead to remote code execution.
Impact
An unauthenticated remote attacker can overwrite arbitrary files on the Aim host, causing denial of service, exfiltration of arbitrary data, and potentially remote code execution.
Attack surface
Reachable over the network through the Aim service handling backup runs; the CVSS vector shows no privileges or user interaction required (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is 0.53113 (98.9th percentile) and the only references are tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade Aim to a version that fixes the _backup_run path handling; if no fixed release is available, restrict or disable the backup run feature.
- Validate and canonicalize run_hash and repo.path, rejecting traversal sequences and absolute paths before any file write.
- Run Aim with least privilege and confine its write access to a dedicated data directory, not system paths.
- Place Aim behind authentication and network controls so it is not exposed to untrusted clients.
Detection
- Monitor Aim process file writes for paths outside its expected data directory, especially overwrites of system or configuration files.
- Alert on backup run requests containing traversal sequences or absolute paths in run_hash or repo.path.
- Watch for unexpected file modification or deletion events on hosts running Aim, correlated with Aim network activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://huntr.com/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0 | ExploitThird Party Advisory |
| https://huntr.com/bounties/c1b17afd-4656-47bb-8310-686a9e1b04a0 | ExploitThird Party Advisory |
Track CVE-2024-6396 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-6396), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
