CVEs-PoC/2024/CVE-2024-24590.md

CVE-2024-24590

Description

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.

POC

Reference

No PoCs from references.

Github

• https://github.com/OxyDeV2/ClearML-CVE-2024-24590
• https://github.com/diegogarciayala/CVE-2024-24590-ClearML-RCE-CMD-POC
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/nomi-sec/PoC-in-GitHub