CVE-2024-8238: Aimstack Aim RCE Vulnerability

CVE-2024-8238 Overview

CVE-2024-8238 affects version 3.22.0 of aimhubio/aim, an open-source experiment tracking tool for machine learning workflows. The AimQL query language relies on an outdated safer_getattr() function from RestrictedPython that fails to block the str.format_map() method. Attackers can use str.format_map() to read arbitrary Python object attributes, including sensitive values such as os.environ. When combined with the ability to write files to a known location on the Aim server, the flaw enables loading a malicious .dll/.so into the Python interpreter for unrestricted code execution.

Critical Impact
Remote attackers can leak server-side secrets and achieve arbitrary code execution on Aim servers running version 3.22.0.

Affected Products

aimhubio/aim version 3.22.0 (Python package)
AimQL query language component
Deployments exposing the Aim server to untrusted query input

Discovery Timeline

2025-03-20 - CVE-2024-8238 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8238

Vulnerability Analysis

The vulnerability resides in AimQL's sandboxing layer, which uses RestrictedPython to restrict attribute access in user-supplied queries. The bundled version of safer_getattr() does not account for str.format_map(), a method that resolves field names by performing attribute and item lookups on the mapping passed to it. Attackers craft format strings such as "{0.__class__.__init__.__globals__[os].environ}".format_map(...) to walk Python's object graph and reach sensitive runtime state. This bypass converts a query interface into a primitive for reading globals, environment variables, and module references.

Once attackers gain read access to interpreter internals, they can locate functions such as ctypes.CDLL or equivalent loaders. If the attacker can place a shared library at a predictable path on the server, the format-string primitive is sufficient to load that library, producing arbitrary native code execution under the Aim server process. The weakness is classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Root Cause

The root cause is reliance on an outdated safer_getattr() allowlist that predates awareness of str.format_map() as an attribute-access vector. The function blocks str.format() and direct attribute access patterns but does not intercept format_map(), leaving a gap in the sandbox.

Attack Vector

Exploitation requires network access to the Aim server's query interface. The attacker submits an AimQL expression containing a crafted format string that invokes str.format_map() on a controlled mapping. The format string traverses object attributes to reach interpreter internals. For code execution, the attacker additionally needs a writable path on the server where a malicious .dll or .so can be staged before the loader call.

No verified proof-of-concept code is published; refer to the Huntr Bug Bounty Report for disclosure details.

Detection Methods for CVE-2024-8238

Indicators of Compromise

AimQL queries containing the substring format_map or unusual nested attribute traversal patterns such as __class__, __globals__, or __builtins__
Unexpected .dll or .so files written to directories reachable by the Aim server process
Aim server processes loading shared libraries from non-standard or user-writable paths

Detection Strategies

Inspect Aim application logs for AimQL query strings referencing dunder attributes or format-map syntax
Monitor file integrity on directories writable by the Aim server, alerting on creation of native libraries
Correlate outbound network connections from the Aim server with recent AimQL query activity to surface data exfiltration

Monitoring Recommendations

Enable verbose query logging on the Aim server and forward logs to a centralized analytics platform
Track child process creation and dlopen/LoadLibrary events on hosts running Aim
Alert on anomalous reads of environment variables or configuration files by the Aim process

How to Mitigate CVE-2024-8238

Immediate Actions Required

Upgrade aimhubio/aim to a version later than 3.22.0 that updates RestrictedPython and patches safer_getattr()
Restrict network exposure of the Aim server to trusted users and internal networks only
Audit the Aim server filesystem for unexpected .dll or .so files and remove any unauthorized artifacts

Patch Information

Review the Huntr Bug Bounty Report for remediation guidance from the maintainers. Upgrade to a fixed release that bundles an updated RestrictedPython capable of blocking str.format_map().

Workarounds

Place the Aim server behind authenticated reverse proxies and disallow anonymous AimQL submissions
Run the Aim server as a low-privilege user with read-only mounts wherever feasible to limit the impact of file-write primitives
Apply egress filtering to prevent the Aim server from contacting arbitrary external hosts

bash

# Configuration example
pip install --upgrade aim  # install a release newer than 3.22.0
# Restrict the listener to a trusted interface
aim up --host 127.0.0.1 --port 43800