CVE-2024-1603: 
Paddle vulnerability analysis and mitigation

A vulnerability was identified in paddlepaddle/paddle version 2.6.0, tracked as CVE-2024-1603. The vulnerability allows arbitrary file read operations through the paddle.vision.ops.read_file functionality. This security issue was discovered and reported on February 6th, 2024, and was officially published on March 23rd, 2024 (Huntr Report, NVD).

The vulnerability is classified as CWE-73: External Control of File Name or Path. It has received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, and a score of 8.2 (HIGH) from huntr.dev with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. The technical issue stems from the lack of directory scope restrictions in the paddle.vision.ops.read_file function, which enables arbitrary file reading capabilities from the system (NVD, Huntr Report).

The vulnerability allows attackers to read arbitrary files from the system, potentially exposing sensitive information. The high confidentiality impact rating indicates that the vulnerability can lead to total information disclosure, potentially exposing all system files that the application has access to (NVD).

The vulnerability has a low attack complexity and requires no privileges or user interaction to exploit. A proof of concept exists demonstrating the ability to read system files such as '/etc/hosts' using the vulnerable function (Huntr Report).

As of the latest reports, the vulnerability is still awaiting a fix. Users of paddlepaddle version 2.6.0 should monitor for updates and consider implementing additional access controls or file path validation mechanisms until an official patch is released (Huntr Report).