Executive Summary:

At Protect AI we are taking a proactive approach to identifying and addressing security risks in AI systems, to provide the world with critical intelligence on vulnerabilities and how to fix them. 

Protect AI’s huntr is the world's first AI/ML bug bounty program. Our community of 15,000+ members hunt for impactful vulnerabilities across the entire OSS AI/ML supply chain. Through our own research and the huntr community, we’ve found the tools used in the supply chain to build the machine learning models that power AI applications to be vulnerable to unique security threats. These tools are Open Source and downloaded thousands of times a month to build enterprise AI Systems. They also likely come out of the box with vulnerabilities that can lead directly to complete system takeovers such as unauthenticated remote code execution or local file inclusion. This report contains 31 vulnerabilities, including some critical vulnerabilities found in the Triton Inference Server and the Intel Neural Compressor. You can find all the details of all this month's vulnerabilities in the table below, or you can head over to protectai.com/sightline, to search the comprehensive database of huntr findings, and download tools to detect, assess and remediate them within your organizations AI Supply chain. 

It is important to note that all vulnerabilities were reported to the maintainers a minimum of 45 days prior to publishing this report, and we continue to work with maintainers to ensure a timely fix prior to publication. The table also includes our recommendations for actions to take immediately, if you have these projects in production. If you need help mitigating these vulnerabilities in the meantime, please reach out, we’re here to help. community@protectai.com.

Log Injection in Triton Inference Server

https://sightline.protectai.com/vulnerabilities/979e1aa6-534e-4478-9bc2-dee60a1971a8/assess

Impact: Allows attackers to inject arbitrary log entries, potentially hiding malicious activities or misleading investigations.

The Triton Inference Server is vulnerable to log injection due to insufficient sanitization of user input in log entries. Attackers can exploit this to forge logs, mislead investigations, or execute ANSI escape sequences that could harm the log viewer's system.


SQL Injection in Neural Solution Server

https://sightline.protectai.com/vulnerabilities/1d6ccb37-f83d-4726-ac7d-06f922792879/assess

Impact: Enables attackers to manipulate database entries and download arbitrary files from the host system.

The Neural Solution Server's task submission API is vulnerable to SQL injection, allowing attackers to alter database records and download files from the server without authorization. This compromises both the integrity of the database and the confidentiality of the server's files.


Unauthorized Memory Access in Triton Inference Server

https://sightline.protectai.com/vulnerabilities/70f44145-9c74-4ee8-9934-034616e8fbcd/assess

Impact: Permits unauthorized read and write operations on memory, potentially leading to a crash or arbitrary code execution.

The Triton Inference Server improperly validates parameters for shared memory operations, allowing attackers to specify illegal memory offsets. This can lead to unauthorized memory access, causing segmentation faults or enabling arbitrary code execution through crafted requests.

CVE

Title

Severity

CVSS

Fixed

Recommendations

CVE-2024-22476

SQL Injection and RCE in neural-compressor

Critical

10

Yes

Upgrade to latest release

CVE-2024-3234

LFI due to the use of outdated components in chuanhuchatgpt34

Critical

9.8

Yes

Upgrade to version 20240305

CVE-2024-3429

Arbitrary file reading via path traversal in lollms

Critical

9.8

Yes

Upgrade to version 9.6

CVE-2024-3584

Path traversal in collection name leads to arbitrary file overwrite in qdrant

Critical

9.8

Yes

Upgrade to version v1.9.0

CVE-2024-3829

Arbitrary file read and write during snapshot recovery in qdrant

Critical

9.8

Yes

Upgrade to version v1.9.0

CVE-2024-4146

User can access unauthorized projects from org in lunary

Critical

9.8

Yes

Upgrade to version 1.2.26

CVE-2024-3149

SSRF in the upload link feature leads to accessing internal Collector API and escalating attack to arbitrary file deletion and Limited LFI in anything-llm

Critical

9.6

Yes

Upgrade to latest release

CVE-2024-5128

IDOR- allow view/update/delete any dataset_prompt/dataset_prompt_variation in any dataset/projects in lunary

Critical

9.4

Yes

Upgrade to version 1.2.25

CVE-2024-3761

Missing Authorization on Delete Datasets in lunary

Critical

9.1

Yes

Upgrade to version 1.2.8

CVE-2024-4315

lack of path sanitization for windows leads to LFI in lollms

Critical

9.1

Yes

Upgrade to version 9.8

CVE-2024-5211

Path traversal to Arbitrary file Read/Delete/Overwrite, DoS attack and admin account takeover in anything-llm

Critical

9.1

Yes

Upgrade to latest release

CVE-2024-0087

Arbitrary File Creation/Appending in Log File Configuration Interface Can Lead to Remote Code Execution in Nvidia Triton Inference server

Critical

9.0

Yes

Upgrade to version 24.04

CVE-2024-3322

Path traversal in native personality 'cyber_security/codeguard' causes Arbitrary File leak and overwrite of directories in lollms-webui

High

8.4

Yes

Upgrade to version 9.5

CVE-2024-5129

Privilege Escalation Vulnerability to delete any datasets in lunary

High

8.2

Yes

Upgrade to version 1.2.8

CVE-2024-3150

Default / manager user can escalate their privileges to Administrator in anything-llm

High

8.1

Yes

Upgrade to latest release

CVE-2024-4287

User with manager role is able to create new Administrator accounts in anything-llm

High

8.1

Yes

Upgrade to latest release

CVE-2024-3504

Improper access control-allow update org user to org owner in lunary

High

8.1

Yes

Upgrade to version 1.2.7

CVE-2024-2914

Tarslip that leads to arbitary file write in djl

High

7.8

Yes

Upgrade to version 0.27.0

CVE-2024-5126

Improper access control-allow update prompt that is deployed in lunary

High

7.6

Yes

Upgrade to version 1.2.25

CVE-2024-1968

Authorization header leakage on same-domain but cross-origin redirect in scrapy

High

7.5

Yes

Upgrade to version 2.11.2

CVE-2024-5130

Unauthenticated delete any dataset in lunary

High

7.5

Yes

Upgrade to version 1.2.8

CVE-2024-5131

IDOR- allow view any prompts in any projects in lunary

High

7.5

Yes

Upgrade to version 1.2.25

CVE-2024-4941

LFI in JSON component in gradio

High

7.5

Yes

Upgrade to version 4.31.4

CVE-2024-4881

Path traversal leads to read any file on the Windows platform system in lollms

High

7.5

Yes

Upgrade to version 5.9.0

CVE-2024-0088

System Shared Memory Operation Interface and Associated Logic Vulnerability - Out-of-Bounds Write in Nvidia Triton Inference Server

Medium

5.5

Yes

Upgrade to version 24.04

CVE-2024-5127

A user from free plan can invite other members assigning them any role and they are able to join the project in lunary

Medium

5.4

Yes

Upgrade to version 1.2.25

CVE-2024-5206

Unexpected Training Data Storage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn

Medium

5.3

Yes

Upgrade to version 1.5.0

CVE-2024-4284

Denial of service by assigning specific user id in anything-llm

Medium

4.9

Yes

Upgrade to latest release

CVE-2024-4286

User modification allows for data modification in anything-llm

Medium

4.9

Yes

Upgrade to latest release

CVE-2024-21792

Insecure Temporary File Permissions in neural compressor

Medium

4.7

Yes

Upgrade to latest release

CVE-2024-0095

Log Injection in Nvidia Triton Inference Server

Medium

4.3

Yes

Upgrade to latest release