CVE-2024-45854

Advisory

MindsDB platform affected versions contain a critical vulnerability in the 'describe' function of the BYOM (Bring Your Own Model) handler. This function deserializes untrusted data from 'inhouse' models using pickle.loads(), potentially allowing arbitrary code execution on the server when a user runs a 'describe' query on a maliciously crafted model. Attackers could exploit this vulnerability to compromise the system, access sensitive data, or perform unauthorized actions. MindsDB users should exercise extreme caution when using 'inhouse' models, especially from untrusted sources, and consider disabling this feature until a security patch is available.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-7vhh-gfjc-x8rm
• https://github.com/mindsdb/mindsdb/blob/v24.9.2.1/mindsdb/integrations/handlers/byom_handler/byom_handler.py#L444-L449
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45854