CVE-2024-0818: 
Paddle vulnerability analysis and mitigation

An arbitrary file overwrite vulnerability via path traversal was discovered in paddlepaddle/paddle versions before 2.6. The vulnerability was identified on January 21st, 2024, and was assigned CVE-2024-0818. The issue affects the download function in paddle.dataset.common module, which allows attackers to exploit path traversal through the module_name parameter (Huntr Report).

The vulnerability exists in the _check_exists_and_download function within paddle.dataset.common. While the function is designed to restrict file operations to the /home/USERNAME/.cache/paddle/dataset directory, it can be bypassed by injecting '../' into the module_name parameter, enabling path traversal. The vulnerability has been assigned a Critical severity rating with a CVSS score of 9.1, characterized by network attack vector, low attack complexity, no privileges required, and no user interaction needed (Huntr Report).

The vulnerability can lead to several severe consequences. Attackers could potentially gain SSH access by injecting RSA keys into authorized_keys files. On web servers, it could enable remote code execution through webshell uploads in PHP or JSP environments, or facilitate Cross-site Scripting (XSS) through HTML file uploads. Additionally, the vulnerability can impact system availability by allowing attackers to overwrite critical configuration files and source code (Huntr Report).

The vulnerability is exploitable by manipulating the module_name parameter in the _check_exists_and_download function. A proof of concept demonstrates that an attacker can write files to arbitrary locations by using path traversal sequences. If an attacker can control the url and md5 parameters, they can also determine the contents of the overwritten files (Huntr Report).

Users are advised to upgrade to paddlepaddle/paddle version 2.6 or later, which contains fixes for this vulnerability (Huntr Report).