CVE-2024-9362: Polyaxon Path Traversal Vulnerability

CVE-2024-9362 Overview

CVE-2024-9362 is an unauthenticated directory traversal vulnerability in Polyaxon, an open-source platform for machine learning lifecycle management. The flaw affects the latest version of Polyaxon and allows remote attackers to read arbitrary files and enumerate directory contents on the underlying host without authentication. Attackers can access sensitive system paths such as /etc, exposing configuration files, credentials, and other confidential data. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated attackers can read arbitrary files and enumerate server directories over the network, resulting in disclosure of system configuration, secrets, and other sensitive data.

Affected Products

Polyaxon (latest version at time of disclosure)
Polyaxon self-hosted deployments exposing the web service to untrusted networks
Polyaxon containers and Kubernetes deployments running the vulnerable release

Discovery Timeline

2025-03-20 - CVE-2024-9362 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9362

Vulnerability Analysis

The vulnerability resides in a Polyaxon HTTP endpoint that constructs filesystem paths from user-supplied input without adequate sanitization. Attackers supply traversal sequences such as ../ in request parameters to escape the intended directory scope. The server then reads the resolved path and returns file contents or directory listings in the HTTP response.

Because the endpoint does not enforce authentication, exploitation requires only network reachability to the Polyaxon service. Any file readable by the Polyaxon process user becomes accessible to the attacker. This commonly includes application configuration, environment files, service tokens, and Linux system files under /etc.

Root Cause

The root cause is missing path canonicalization and insufficient input validation on a directory or file access route. The application accepts relative path components in user input and passes them into filesystem calls without confirming the resolved path stays within an allowed base directory. This is a classic [CWE-22] path traversal defect combined with a missing authentication check on a sensitive endpoint.

Attack Vector

Exploitation is remote and unauthenticated over the network. An attacker crafts HTTP requests containing directory traversal sequences targeting the vulnerable endpoint. The server responds with the contents of the referenced file or directory. No user interaction is required, and no privileges are needed on the target system. See the Huntr Vulnerability Bounty report for technical details.

Detection Methods for CVE-2024-9362

Indicators of Compromise

HTTP requests to Polyaxon endpoints containing traversal sequences such as ../, ..%2f, ..%5c, or URL-encoded variants
Responses from the Polyaxon service returning contents of system files including /etc/passwd, /etc/shadow, or /proc/self/environ
Anomalous outbound reads of application configuration or secrets files by the Polyaxon process
Access log entries showing unauthenticated file or directory retrieval from the Polyaxon web service

Detection Strategies

Inspect web server and reverse proxy logs for URI patterns containing ..%2f, ..%5c, or repeated ../ sequences targeting Polyaxon routes
Deploy web application firewall (WAF) rules that flag path traversal payloads on Polyaxon hosts
Alert on Polyaxon service process reads of files outside its expected working directories, such as /etc, /root, or /home
Correlate unauthenticated HTTP responses returning large or unusual payloads from the Polyaxon service

Monitoring Recommendations

Enable verbose HTTP access logging on Polyaxon and any fronting reverse proxy or ingress controller
Ship application and system logs to a centralized SIEM or data lake for retention and analysis
Establish baselines for normal Polyaxon endpoint access patterns to make traversal attempts easier to identify
Monitor for spikes in 200-OK responses to unauthenticated requests against Polyaxon file-serving routes

How to Mitigate CVE-2024-9362

Immediate Actions Required

Restrict network exposure of Polyaxon services to trusted networks or VPN-only access until a fixed release is applied
Place Polyaxon behind an authenticated reverse proxy that enforces access control on all routes
Deploy WAF rules to block path traversal sequences in HTTP requests to Polyaxon endpoints
Audit host filesystems for evidence of unauthorized file reads and rotate any credentials that may have been exposed

Patch Information

At the time of publication, no fixed vendor release was linked in the NVD record for CVE-2024-9362. Monitor the Polyaxon project releases and the Huntr disclosure for updates. Apply the vendor-supplied patch as soon as it is available and verify the version after upgrade.

Workarounds

Block Polyaxon HTTP endpoints from untrusted networks using firewall or network policy rules
Enforce authentication at the ingress or reverse proxy layer for every Polyaxon route
Run the Polyaxon process as an unprivileged user with a restricted filesystem view, using container read-only mounts or Linux namespaces
Configure the reverse proxy to normalize and reject URIs containing traversal sequences before forwarding to Polyaxon

bash

# Example NGINX reverse proxy configuration blocking traversal patterns
location / {
    if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%5c)") {
        return 403;
    }
    proxy_pass http://polyaxon_backend;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}