CVE-2024-5980

The vulnerability concerns the tar.gz file handling mechanism in the plugin server (plugin_server) within the LightningApp application. An attacker can prepare a malicious tar.gz archive containing files with paths containing path traversal sequences (e.g., '../'). When LightningApp processes such a file through the /v1/runs endpoint, malicious files are extracted outside the intended target directory and can reach arbitrary locations in the victim's file system. Placing appropriate executable or configuration files in critical locations can lead to remote code execution.

An attacker can write arbitrary files to any directory in the victim's local file system, which may lead to remote code execution (RCE) and complete system compromise.

Apply the patch available in the vendor's repository (commit 330af381de88cff17515418a341cbc1f9f127f9a on GitHub). It is recommended to update to a version containing the specified fix. Until an update is applied, consider disabling the plugin_server feature or restricting network access to the /v1/runs endpoint.

lightning-ai/pytorch-lightning in version v2.2.4 when LightningApp application runs with plugin_server enabled