CVE-2024-12777

Description

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests.

CVSS v3.1 Score

5.9

MEDIUM

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-1088 CWE-1088

Affected Products

Vendor	Product	Versions
aimstack	aim	All

References

Exploits

https://huntr.com/bounties/cdf8db79-c290-4fe5-9383-4c518bfba4a8 https://huntr.com/bounties/cdf8db79-c290-4fe5-9383-4c518bfba4a8

Frequently Asked Questions

What is CVE-2024-12777? +

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking server, which is single-threaded, can be made unresponsive by requesting it to connect to an unresponsive socket via sshfs. The lack of an additional timeout setting in the sshfs-client causes the server to hang for a significant amount of time, preventing it from responding to other requests. It has a CVSS v3.1 base score of 5.9 (MEDIUM).

How severe is CVE-2024-12777? +

CVE-2024-12777 has a CVSS v3.1 score of 5.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-12777? +

CVE-2024-12777 affects products from aimstack, specifically: aim. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-12777? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-8061 7.5

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the …

CVE-2024-8062 7.5

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a …

CVE-2025-4656 3.1

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled …

CVE-2024-2195 9.8

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions …

CVE-2024-6396 9.8

A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host …

CVE-2024-7760 9.6

aimhubio/aim version 3.22.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the tracking server. The vulnerability is due to overly …