Vulnerability DatabaseCVE-2024-2383

CVE-2024-2383:
Python vulnerability analysis and mitigation

Overview

A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability was discovered in June 2024 and affects the ZenML server application. The issue was addressed in version 0.56.3 (NVD).

Technical details

The vulnerability stems from the absence of proper security headers, specifically X-Frame-Options and Content-Security-Policy HTTP headers, in the ZenML server's responses. This security gap allows the application UI to be embedded within an iframe on a malicious page. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity but requiring user interaction (NVD).

Impact

The vulnerability enables attackers to embed the ZenML application UI within an iframe on a malicious webpage. This could lead to unauthorized actions by tricking users into interacting with the interface under the attacker's control, potentially compromising the security of the application (NVD).

Mitigation and workarounds

The vulnerability has been fixed in ZenML version 0.56.3. The fix includes implementing appropriate security headers to prevent clickjacking attacks. Users should upgrade to version 0.56.3 or later to protect against this vulnerability. The patch adds proper X-Frame-Options and Content-Security-Policy HTTP headers to the server's responses (GitHub Patch).