CVE-2024-42351: Galaxyproject Galaxy Info Disclosure Bug

CVE-2024-42351 Overview

CVE-2024-42351 is a critical vulnerability affecting Galaxy, the popular open-source platform for data analysis, workflow authoring, and scientific research. This authorization bypass vulnerability allows unauthenticated attackers to potentially replace the contents of public datasets, leading to significant data loss or tampering risks for research organizations and institutions relying on Galaxy for their data infrastructure.

Critical Impact

Attackers can replace contents of public datasets without authentication, causing data integrity compromise and potential loss of critical research data across affected Galaxy instances.

Affected Products

• Galaxyproject Galaxy (all versions prior to patch)
• Galaxy release_21.05 and later supported branches
• All Galaxy instances hosting public datasets

Discovery Timeline

• 2024-09-20 - CVE-2024-42351 published to NVD
• 2025-08-15 - Last updated in NVD database

Technical Details for CVE-2024-42351

Vulnerability Analysis

This vulnerability falls under CWE-200 (Information Exposure) and represents a significant authorization bypass in Galaxy's dataset management functionality. The flaw allows remote attackers to manipulate public datasets without requiring any authentication or special privileges. The network-accessible nature of this vulnerability means any attacker with network access to a Galaxy instance can potentially exploit it to modify research data.

The impact is severe for organizations using Galaxy for data analysis workflows, as compromised datasets could corrupt ongoing research, poison training data, or lead to incorrect scientific conclusions. Given Galaxy's widespread use in bioinformatics and genomics research, the potential for cascading effects from data tampering is substantial.

Root Cause

The root cause of CVE-2024-42351 lies in insufficient access controls governing public dataset modification operations. The Galaxy platform failed to properly validate authorization when processing requests to update or replace dataset contents, allowing unauthenticated users to perform operations that should be restricted to authorized dataset owners or administrators.

Attack Vector

The vulnerability is exploitable remotely over the network without requiring user interaction or authentication. An attacker can target any Galaxy instance accessible over the network and send specially crafted requests to modify public datasets. The attack does not require any prior knowledge of user credentials or session tokens, making it particularly dangerous for internet-facing Galaxy deployments.

The exploitation process involves identifying a target Galaxy instance, locating public datasets, and sending unauthorized modification requests to replace dataset contents. The lack of proper authorization checks means these requests are processed as legitimate operations.

Detection Methods for CVE-2024-42351

Indicators of Compromise

• Unexpected modifications to public datasets with no corresponding audit trail from authorized users
• Anomalous API requests targeting dataset modification endpoints from unauthenticated sources
• Changes to dataset checksums or metadata without corresponding authorized user activity
• Unusual network traffic patterns to Galaxy dataset management endpoints

Detection Strategies

• Monitor Galaxy application logs for unauthorized dataset modification attempts
• Implement integrity checking mechanisms to detect unauthorized changes to public datasets
• Review access logs for dataset write operations that lack proper authentication tokens
• Deploy web application firewalls (WAF) to detect and block suspicious dataset manipulation requests

Monitoring Recommendations

• Enable comprehensive audit logging for all dataset operations in Galaxy instances
• Implement real-time alerting for dataset modifications outside normal business hours
• Configure network monitoring to track access patterns to Galaxy API endpoints
• Establish baseline behavior for dataset access and modification to detect anomalies

How to Mitigate CVE-2024-42351

Immediate Actions Required

• Upgrade Galaxy to the latest patched version immediately
• Review all public datasets for unauthorized modifications since deployment
• Temporarily restrict network access to Galaxy instances until patching is complete
• Enable additional logging to monitor for exploitation attempts

Patch Information

The Galaxy Project has released official patches to address CVE-2024-42351. Multiple patch files are available for different Galaxy branches:

• Galaxy Project Patch GX-2024-0001-1 (commit 022da344a02bafd604402ac8e253e0014f6e2e08)
• Galaxy Project Patch GX-2024-0001-2 (commit 15060a6cb222f2fcfc687d0f0260f1eb1b9c757b)
• Galaxy Project Patch GX-2024-0001-3 (commit 235f1d8b400708556732b9dda788c919ebf3bb80)

For additional details, consult the GitHub Security Advisory GHSA-5639-cmph-9j4v.

Workarounds

• There are no known workarounds for this vulnerability according to the vendor advisory
• Organizations should prioritize patching as the only effective remediation
• Consider temporarily taking Galaxy instances offline if immediate patching is not possible
• Implement network-level access restrictions to limit exposure while scheduling maintenance

# Apply Galaxy security patch
cd /path/to/galaxy
wget https://depot.galaxyproject.org/patch/GX-2024-0001/022da344a02bafd604402ac8e253e0014f6e2e08.patch
git apply 022da344a02bafd604402ac8e253e0014f6e2e08.patch
# Restart Galaxy services after patching
sudo systemctl restart galaxy