GHSA-r49h-6qxq-624f

Weave server API vulnerable to arbitrary file leak

Source: GitHub Advisory Database (reviewed) High CVE-2024-7340

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	weave	< 0.50.8	0.50.8

Details

As written in the advisory (Markdown source, shown as plain text).

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-7340 advisory
https://github.com/wandb/weave/pull/1657 web
https://github.com/wandb/weave/commit/f43d5fb75e0d52933a52ecd9a0ce2f9b082e6c9f web
https://github.com/wandb/weave package
https://research.jfrog.com/vulnerabilities/wandb-weave-server-remote-arbitrary-file-leak-jfsa-2024-001039248 web