Cybersecurity experts have revealed a serious vulnerability affecting the Lightning AI Studio, a development platform that, if exploited, poses a significant risk of remote code execution. This flaw has been assigned a CVSS score of 9.4, indicating its critical nature and potential for severe repercussions.
The vulnerability permits attackers to execute arbitrary commands with root privileges, as outlined in a report by application security firm Noma. The researchers emphasized that exploiting this hidden URL parameter could lead to various malicious activities, including the extraction of sensitive data such as access tokens and user information.
The security issue resides within a JavaScript component, which allows unrestrained access to a victim’s development environment and the capability to execute commands in a privileged context. The Noma report identified a hidden parameter dubbed “command” within user-specific URLs, enabling attackers to pass Base64-encoded instructions to be executed on the host system.
This loophole can be exploited to execute commands capable of extracting critical information such as access tokens and user profiles to a server controlled by an attacker. If successfully leveraged, this vulnerability grants adversaries the power to execute privileged commands, access sensitive data, and manipulate the file system for file creation, deletion, or modification.
To successfully execute such an attack, malicious actors require only prior knowledge of a user’s profile username linked to the Lightning AI Studio, which can be easily obtained from the Studio templates gallery. With this information, an attacker can generate a harmful link that triggers code execution on the targeted Studio under root permissions. Following responsible disclosure on October 14, 2024, the Lightning AI team remedied the vulnerability by October 25.
The researchers highlighted the necessity of securing tools and systems used in developing AI models due to the sensitive nature of their applications. The incident underscores the importance of vigilance within the cybersecurity sphere, especially as companies increasingly rely on such platforms.
Update
In response to inquiries from The Hacker News, Lightning AI stated that the vulnerability was addressed immediately upon notification. They confirmed that no evidence suggested the issue was exploited prior to the patch and that a thorough security review showed no unauthorized access occurred before the fix was implemented.
This article was updated following Lightning AI’s response to clarify that the vulnerability was never exploited.
