CVE-2024-42351: Galaxyproject Galaxy Info Disclosure Bug

CVE-2024-42351 Overview

CVE-2024-42351 is a critical vulnerability affecting Galaxy, the popular open-source platform for data analysis, workflow authoring, and scientific research. This authorization bypass vulnerability allows unauthenticated attackers to potentially replace the contents of public datasets, leading to significant data loss or tampering risks for research organizations and institutions relying on Galaxy for their data infrastructure.

Critical Impact
Attackers can replace contents of public datasets without authentication, causing data integrity compromise and potential loss of critical research data across affected Galaxy instances.

Affected Products

Galaxyproject Galaxy (all versions prior to patch)
Galaxy release_21.05 and later supported branches
All Galaxy instances hosting public datasets

Discovery Timeline

2024-09-20 - CVE-2024-42351 published to NVD
2025-08-15 - Last updated in NVD database

Technical Details for CVE-2024-42351

Vulnerability Analysis

This vulnerability falls under CWE-200 (Information Exposure) and represents a significant authorization bypass in Galaxy's dataset management functionality. The flaw allows remote attackers to manipulate public datasets without requiring any authentication or special privileges. The network-accessible nature of this vulnerability means any attacker with network access to a Galaxy instance can potentially exploit it to modify research data.

The impact is severe for organizations using Galaxy for data analysis workflows, as compromised datasets could corrupt ongoing research, poison training data, or lead to incorrect scientific conclusions. Given Galaxy's widespread use in bioinformatics and genomics research, the potential for cascading effects from data tampering is substantial.

Root Cause

The root cause of CVE-2024-42351 lies in insufficient access controls governing public dataset modification operations. The Galaxy platform failed to properly validate authorization when processing requests to update or replace dataset contents, allowing unauthenticated users to perform operations that should be restricted to authorized dataset owners or administrators.

Attack Vector

The vulnerability is exploitable remotely over the network without requiring user interaction or authentication. An attacker can target any Galaxy instance accessible over the network and send specially crafted requests to modify public datasets. The attack does not require any prior knowledge of user credentials or session tokens, making it particularly dangerous for internet-facing Galaxy deployments.

The exploitation process involves identifying a target Galaxy instance, locating public datasets, and sending unauthorized modification requests to replace dataset contents. The lack of proper authorization checks means these requests are processed as legitimate operations.

Detection Methods for CVE-2024-42351

Indicators of Compromise

Unexpected modifications to public datasets with no corresponding audit trail from authorized users
Anomalous API requests targeting dataset modification endpoints from unauthenticated sources
Changes to dataset checksums or metadata without corresponding authorized user activity
Unusual network traffic patterns to Galaxy dataset management endpoints

Detection Strategies

Monitor Galaxy application logs for unauthorized dataset modification attempts
Implement integrity checking mechanisms to detect unauthorized changes to public datasets
Review access logs for dataset write operations that lack proper authentication tokens
Deploy web application firewalls (WAF) to detect and block suspicious dataset manipulation requests

Monitoring Recommendations

Enable comprehensive audit logging for all dataset operations in Galaxy instances
Implement real-time alerting for dataset modifications outside normal business hours
Configure network monitoring to track access patterns to Galaxy API endpoints
Establish baseline behavior for dataset access and modification to detect anomalies

How to Mitigate CVE-2024-42351

Immediate Actions Required

Upgrade Galaxy to the latest patched version immediately
Review all public datasets for unauthorized modifications since deployment
Temporarily restrict network access to Galaxy instances until patching is complete
Enable additional logging to monitor for exploitation attempts

Patch Information

The Galaxy Project has released official patches to address CVE-2024-42351. Multiple patch files are available for different Galaxy branches:

Galaxy Project Patch GX-2024-0001-1 (commit 022da344a02bafd604402ac8e253e0014f6e2e08)
Galaxy Project Patch GX-2024-0001-2 (commit 15060a6cb222f2fcfc687d0f0260f1eb1b9c757b)
Galaxy Project Patch GX-2024-0001-3 (commit 235f1d8b400708556732b9dda788c919ebf3bb80)

For additional details, consult the GitHub Security Advisory GHSA-5639-cmph-9j4v.

Workarounds

There are no known workarounds for this vulnerability according to the vendor advisory
Organizations should prioritize patching as the only effective remediation
Consider temporarily taking Galaxy instances offline if immediate patching is not possible
Implement network-level access restrictions to limit exposure while scheduling maintenance

bash

# Apply Galaxy security patch
cd /path/to/galaxy
wget https://depot.galaxyproject.org/patch/GX-2024-0001/022da344a02bafd604402ac8e253e0014f6e2e08.patch
git apply 022da344a02bafd604402ac8e253e0014f6e2e08.patch
# Restart Galaxy services after patching
sudo systemctl restart galaxy