CVE-2024-25723
published 2024-02-27CVE-2024-25723: ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the…
PriorityP184high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
70.58%
99.3th percentile
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zenml | zenml | < 0.42.2 | 0.42.2 |
| zenml | zenml | — | — |
| zenml | zenml | >= 0 < 0.42.2 | 0.42.2 |
| zenml | zenml | >= 0.43.0 < 0.43.1 | 0.43.1 |
| zenml | zenml | >= 0.44.0 < 0.44.4 | 0.44.4 |
| zenml | zenml | >= 0.44.0 < 0.44.4 | 0.44.4 |
| zenml | zenml | >= 0.45.0 < 0.46.7 | 0.46.7 |
| zenml | zenml | >= 0.45.0 < 0.46.7 | 0.46.7 |
Detection & IOCsextracted from sources · hover to see the quote
url/api/v1/info
- →Detect exploitation attempts by monitoring HTTP PUT/POST requests to the /api/v1/users/{user_name_or_id}/activate endpoint that include a new password in the request body without proper prior authentication. ↗
- →Use the Shodan favicon hash -2028554187 or FOFA body='ZenML' to discover internet-exposed ZenML Server instances for asset inventory and patch verification.
- →Extract the ZenML version from the /api/v1/info JSON response using the regex '"version":"(.*?)"' to confirm whether the instance is running a vulnerable release.
- ·Patched versions exist in multiple backport branches; ensure detection logic excludes 0.44.4, 0.43.1, and 0.42.2 in addition to >= 0.46.7 to avoid false positives on patched older deployments. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ZenML Server Remote Privilege Escalation Vulnerability
osv·2024-02-27
CVE-2024-25723 [HIGH] ZenML Server Remote Privilege Escalation Vulnerability
ZenML Server Remote Privilege Escalation Vulnerability
ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
GHSA
ZenML Server Remote Privilege Escalation Vulnerability
ghsa·2024-02-27
CVE-2024-25723 [HIGH] CWE-284 ZenML Server Remote Privilege Escalation Vulnerability
ZenML Server Remote Privilege Escalation Vulnerability
ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.
No detection rules found.
Nuclei
ZenML ZenML Server - Improper Authentication
nuclei·CVSS 8.8
CVE-2024-25723 [HIGH] ZenML ZenML Server - Improper Authentication
ZenML ZenML Server - Improper Authentication
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body.
Template:
id: CVE-2024-25723
info:
name: ZenML ZenML Server - Improper Authentication
author: David Botelho Mariano
severity: critical
description: |
ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{user_name_or_id}/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body.
impact: |
Successful exploitation could lead to u
No writeups or analysis indexed.
https://github.com/zenml-io/zenmlhttps://github.com/zenml-io/zenml/compare/0.42.1...0.42.2https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4https://www.zenml.io/blog/critical-security-update-for-zenml-usershttps://github.com/zenml-io/zenmlhttps://github.com/zenml-io/zenml/compare/0.42.1...0.42.2https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4https://www.zenml.io/blog/critical-security-update-for-zenml-users
2024-02-27
Published