CVE-2024-24593: Clear ClearML API Server CSRF Vulnerability

CVE-2024-24593 Overview

CVE-2024-24593 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the API server component of Allegro AI's ClearML platform in all versions up to and including 1.14.1. The flaw allows a remote attacker to impersonate an authenticated user by tricking them into loading maliciously crafted HTML that issues API requests to the ClearML backend. Successful exploitation can compromise confidential workspaces, leak sensitive files, and reach ClearML instances deployed inside otherwise closed networks. The vulnerability targets a core MLOps platform used to manage machine learning experiments, data, and models.

Critical Impact
An attacker can hijack authenticated ClearML sessions through a malicious web page, exfiltrate confidential ML artifacts, and pivot to internal ClearML deployments behind network boundaries.

Affected Products

Allegro AI ClearML API server, all versions up to 1.14.1
ClearML self-hosted deployments
ClearML instances within isolated or closed networks reachable by authenticated user browsers

Discovery Timeline

2024-02-06 - CVE-2024-24593 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24593

Vulnerability Analysis

The ClearML API server fails to enforce anti-CSRF protections on state-changing API endpoints. When an authenticated ClearML user visits an attacker-controlled page, the browser automatically attaches valid session credentials to forged requests issued by the malicious HTML. The API server processes these requests as if they originated from the legitimate user.

Exploitation requires user interaction, but the attack complexity is low and no privileges are needed by the attacker. Once triggered, the attacker can read or modify projects, tasks, datasets, and model artifacts within the victim's workspace. Because the request originates from the victim's browser, the attack works against ClearML servers deployed in private networks that are not directly reachable from the internet.

Root Cause

The root cause is missing CSRF protection on the ClearML API server. The application does not validate an unpredictable per-session token, nor does it enforce strict SameSite cookie semantics or origin checks on sensitive endpoints. As a result, the API trusts ambient browser credentials on cross-origin requests, satisfying the conditions for CWE-352.

Attack Vector

The attack vector is network-based and requires the victim to load attacker-controlled content while authenticated to ClearML. The malicious page issues POST or PUT requests to the ClearML API server using standard HTML forms or fetch calls. The victim's browser attaches the authenticated session, and the server executes the impersonated actions. Refer to the HiddenLayer Research Article for technical details on the exploitation chain against MLOps platforms.

No verified public proof-of-concept code is available. The vulnerability mechanism follows standard CSRF patterns against unprotected JSON API endpoints.

Detection Methods for CVE-2024-24593

Indicators of Compromise

Unexpected ClearML API requests with Referer or Origin headers pointing to external or untrusted domains
Unusual creation, modification, or deletion of ClearML projects, tasks, or datasets outside normal user working hours
Authenticated API calls immediately following user navigation to unfamiliar external URLs in browser history or proxy logs
Sudden exfiltration patterns from ClearML storage backends linked to legitimate user sessions

Detection Strategies

Inspect ClearML API server access logs for state-changing requests whose Origin header does not match the ClearML domain
Correlate web proxy logs with ClearML API activity to identify requests triggered by third-party page loads
Alert on bulk read or download operations against confidential workspaces performed within seconds of a session start
Monitor for anomalous user-agent or session fingerprint mismatches against expected ClearML client tooling

Monitoring Recommendations

Enable verbose audit logging on the ClearML API server and forward logs to a centralized SIEM
Track per-user baselines for API endpoint usage and flag deviations
Monitor outbound traffic from ClearML instances to detect data staging or exfiltration following suspected CSRF abuse
Review browser security telemetry for ClearML users to identify visits to suspicious domains during active sessions

How to Mitigate CVE-2024-24593

Immediate Actions Required

Upgrade the ClearML API server to a version later than 1.14.1 that includes the CSRF fix
Audit ClearML projects, datasets, and access logs for unauthorized changes since deployment
Restrict ClearML web interface access to trusted networks or VPN-only access where possible
Force re-authentication of all active ClearML user sessions after patching

Patch Information

Upgrade ClearML beyond version 1.14.1. Consult the HiddenLayer Research Article and the official ClearML release notes for the fixed version and patch details. Verify the deployed version using the API server health endpoint after upgrading.

Workarounds

Configure session cookies with SameSite=Strict at the reverse proxy layer to block cross-site cookie attachment
Deploy a web application firewall rule that rejects ClearML API requests lacking a same-origin Origin or Referer header
Require users to access ClearML from a dedicated browser profile that does not share cookies with general browsing
Segment the ClearML deployment behind an authenticating reverse proxy that enforces origin validation

bash

# Example NGINX reverse proxy snippet enforcing same-origin checks
map $http_origin $clearml_allowed_origin {
    default 0;
    "https://clearml.internal.example.com" 1;
}

server {
    listen 443 ssl;
    server_name clearml.internal.example.com;

    location /api/ {
        if ($request_method ~ ^(POST|PUT|DELETE|PATCH)$) {
            if ($clearml_allowed_origin = 0) {
                return 403;
            }
        }
        proxy_pass http://clearml-apiserver:8008;
        proxy_cookie_path / "/; SameSite=Strict; Secure; HttpOnly";
    }
}