CVE-2024-24590-ClearML-RCE-CMD-POC

ClearML 漏洞利用脚本 本仓库包含一个针对 CVE-2024-24590 的 Python 漏洞利用脚本。该脚本旨在向 ClearML 上传一个恶意 pickle 文件，从而执行反向 Shell 或自定义命令。 功能 向 ClearML 上传恶意 pickle 工件。 在目标机器上执行反向 Shell 或自定义命令。 支持自定义项目和任务名称。 允许在任务上设置标签。 用法 先决条件 Python 3.x ClearML SDK argparse（通常已随 Python 附带） 安装 1. 克隆仓库： git clone...

CVE-2024-24590-ClearML-RCE-Exploit

CVE-2024-24590 — ClearML Pickle 工件远程代码执行（RCE） 概述 字段| 详情 ---|--- CVE| CVE-2024-24590 软件| ClearML 受影响版本| 0.17.0 – 1.14.2 漏洞类型| 任务工件的不安全 pickle 反序列化 认证要求| 需要对 ClearML 项目具有写入权限 影响| 在加载该工件的任何机器上实现远程代码执行 测试环境| Ubuntu 22.04、Python 3.9+ 描述 ClearML 是一个 MLOps 平台，用于跟踪实验、管理数据集并在团队成员之间共享工件（模型、文件、对象）。当任务工件以...

ClearML-CVE-2024-24590

/ | | | / | | | \ / \ / | | | | | | \ / | | | | | | | | | | | | |/ / | '| |/| | | | /| | | | | | || | / | | | | | | | | | | | || | | |||,|| || ||| || / | - 2024-24590 x OxyDe ClearML Pickle 工件上传 PoC 本项目演示如何通过命令行参数动态上传 pickle 工件到 ClearML，并支持配置参数。该脚本初始化一个 ClearML 任务，动态配置反向 shell...

CVE-2024-24590

CVE-2024-24590 在 Allegro AI 的 ClearML 平台客户端 SDK 的 0.17.0 至 1.14.2 版本中，存在未受信任数据反序列化问题，导致恶意上传的工件与用户交互时可在终端用户系统上执行任意代码。 使用方法 1. 粘贴提供的凭据并运行 clearml-init 2. 在一个终端中运行 exploit.py Python 脚本，在另一个终端中设置监听器 3. 可能需要多次运行 exploit 才能获得反弹 shell usage: exploit.py -h -i IP -p PORT -P PROJECT options: -h, --help...

ClearML-CVE-2024-24590-RCE

Clearml-CVE-2024-24590 CVE-2024-24590 是一种可在服务器端存在不当反序列化时被利用的漏洞，此处指 Clearml。 当攻击者创建恶意的 Pickle 文件时，他们可以在反序列化该 Pickle 文件的受害者系统上执行任意代码，并可进一步升级为反弹 Shell，从而实现远程命令执行。 别忘了安装 clearml 库 python -m venv .g source .g/bin/activate/ pip install clearml...

CVE-2024-24590

ClearML 漏洞利用 该仓库包含 ClearML 中反序列化漏洞的概念验证利用代码，可实现远程命令执行。此利用演示了如何将恶意 pickle 工件上传到 ClearML 以获得反向 shell。 先决条件 在开始之前，请确保您满足以下要求： 一台运行 ClearML 的机器。 Python 3.8 或更高版本。 已安装 clearml 库。您可以使用 pip 安装： pip install clearml clearml-init 按照屏幕提示操作，并在提示时粘贴您的配置设置。 使用以下命令启动监听器： nc -lvnp 服务器处理有效载荷可能需要一分钟左右，请耐心等待。...

pickle_exploit

PickleExploit Demostración de una vulnerabilidad de ejecución remota de código mediante la serialización Pickle en ClearML 🖥️ Este script fue desarrollado por h3x0v3rl0rd. Esta prueba de concepto PoC demuestra una posible vulnerabilidad de seguridad relacionada con la serialización y...

PYSEC-2026-1255 clearml is vulnerable to Path Traversal through its `safe_extract` function

A vulnerability in clearml versions before 2.0.2 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files...

clearml is vulnerable to Path Traversal through its `safe_extract` function

A vulnerability in clearml versions before 2.0.2 allows for path traversal due to improper handling of symbolic and hard links in the safeextract function. This flaw can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution if critical files...

PYSEC-2026-1257 Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

Allegro AI ClearML vulnerable to deserialization of untrusted data

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...

PYSEC-2026-1258 Allegro AI ClearML path traversal vulnerability

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance

Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...

PYSEC-2026-1256 Allegro AI ClearML vulnerable to deserialization of untrusted data

Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...

Allegro AI ClearML path traversal vulnerability

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

Relative Path Traversal

Overview clearml is a ClearML - Auto-Magical Experiment Manager, Version Control, and MLOps for AI Affected versions of this package are vulnerable to Relative Path Traversal via the StorageManager.extracttocache process. An attacker can write arbitrary files to the filesystem by uploading a...

CVE-2026-8387

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting .zip archives using the ZipFile.extractall method in StorageManager.extracttocache. This issue arises due to the lack of path traversal validation, enabling an attacker to...

CVE-2026-8387

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting .zip archives using the ZipFile.extractall method in StorageManager.extracttocache. This issue arises due to the lack of path traversal validation, enabling an attacker to...

CVE-2026-8387 Relative Path Traversal in allegroai/clearml

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting .zip archives using the ZipFile.extractall method in StorageManager.extracttocache. This issue arises due to the lack of path traversal validation, enabling an attacker to...

CVE-2026-8387 Relative Path Traversal in allegroai/clearml

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting .zip archives using the ZipFile.extractall method in StorageManager.extracttocache. This issue arises due to the lack of path traversal validation, enabling an attacker to...