Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2024-2195

CVE-2024-2195:
Aim Web API vulnerable to Remote Code Execution

9.8

CVSS Score

Basic Information

CVE ID
CVE-2024-2195
GHSA ID
GHSA-mxvw-cj37-8g2h
EPSS Score
-
CWE
CWE-94
Published
4/10/2024
Updated
10/25/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
aimpip>= 3.0.0, <= 3.25.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability description explicitly identifies the run_search_api function in aim/web/api/runs/views.py as the location of the RCE flaw. The function's handling of the 'query' parameter with insufficient access controls to the RunView object creates an injection vector. Multiple authoritative sources (GitHub Advisory, NVD, huntr) consistently reference this function as the attack surface. The CWE-94 classification confirms this is a direct code injection scenario rather than a configuration or dependency issue.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *riti**l R*mot* *o** *x**ution (R**) vuln*r**ility w*s i**nti*i** in t** *im*u*io/*im proj**t, sp**i*i**lly wit*in t** `/*pi/runs/s**r**/run/` *n*point, *****tin* v*rsions >= *.*.*. T** vuln*r**ility r*si**s in t** `run_s**r**_*pi` *un*tion o* t**

Reasoning

T** vuln*r**ility **s*ription *xpli*itly i**nti*i*s t** run_s**r**_*pi *un*tion in *im/w**/*pi/runs/vi*ws.py *s t** lo**tion o* t** R** *l*w. T** *un*tion's **n*lin* o* t** 'qu*ry' p*r*m*t*r wit* insu**i*i*nt ****ss *ontrols to t** RunVi*w o*j**t *r*