Lightning AI Studio Vulnerability

Critical Security Flaw in AI Development Platform

Cybersecurity researchers have disclosed a critical security flaw in the Lightning AI Studio development platform that, if successfully exploited, could allow for remote code execution.

Vulnerability Details

The vulnerability, rated a CVSS score of 9.4, enables "attackers to potentially execute arbitrary commands with root privileges" by exploiting a hidden URL parameter, application security firm Noma said in a report shared with The Hacker News.

Impact of the Vulnerability

The issue is embedded in a piece of JavaScript code that could facilitate unfettered access to a victim’s development environment, as well as run arbitrary commands on an authenticated target in a privileged context.

How the Vulnerability Works

Noma said it found a hidden parameter called "command" in user-specific URLs – e.g., "lightning.ai/PROFILE_USERNAME/vision-model/studios/STUDIO_PATH/terminal?fullScreen=true&command=cmVzc…" – which could be used to pass a Base64-encoded instruction to be executed on the underlying host.

Exploitation of the Vulnerability

All an attacker needs to pull this off is prior knowledge of a profile username and their associated Lightning AI Studio, details that are publicly available via the Studio templates gallery.

Exploitation Steps

Armed with this information, the threat actor can then craft a malicious link such that it triggers code execution on the identified Studio under root permissions. Following responsible disclosure on October 14, 2024, the problem has been resolved by the Lightning AI team as of October 25.

Conclusion

Vulnerabilities like these underscore the importance of mapping and securing the tools and systems used for building, training, and deploying AI models because of their sensitive nature.

Stay Informed

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.