CVE-2024-43779
Published: 06 February 2025
Summary
CVE-2024-43779 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Clear Clearml Enterprise Server. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Credential Access (T1212); ranked in the top 43.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AU-13 (Monitoring for Information Disclosure).
Deeper analysis
CVE-2024-43779 is an information disclosure vulnerability in the Vault API functionality of ClearML Enterprise Server version 3.22.5-1533. It allows a specially crafted HTTP request to read vaults that have been previously disabled, potentially leaking sensitive credentials stored within them. The issue is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-522 (Insufficiently Protected Credentials), with a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) with low complexity and no user interaction required. By sending a series of HTTP requests, the attacker can access and disclose contents of disabled vaults, achieving high-impact confidentiality loss (C:H) in a scoped manner (S:C), without affecting integrity or availability.
Mitigation details are available in the Talos Intelligence advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2024-2112. The vulnerability was published on 2025-02-06.
ClearML Enterprise Server is part of an AI/ML operations platform for managing machine learning experiments and pipelines, making leaked vault credentials particularly sensitive for AI workflows involving secure access to models, data, or compute resources. No real-world exploitation has been reported in the provided information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53883
Vulnerability details
An information disclosure vulnerability exists in the Vault API functionality of ClearML Enterprise Server 3.22.5-1533. A specially crafted HTTP request can lead to reading vaults that have been previously disabled, possibly leaking sensitive credentials. An attacker can send a series…
more
of HTTP requests to trigger this vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability allows authenticated low-privilege users to access disabled vaults via API, disclosing sensitive credentials and configuration data, enabling exploitation for credential access (T1212), unsecured credential theft (T1552), and data collection from configuration repositories (T1602).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for logical access, directly preventing low-privileged attackers from reading disabled vaults via crafted API requests.
SI-10 validates information inputs like specially crafted HTTP requests to the Vault API, blocking exploitation that leads to sensitive credential disclosure.
AU-13 monitors for information disclosure, identifying unauthorized access to disabled vaults and potential leakage of sensitive credentials.