CVE-2024-24590 PoC — Allegro 代码问题漏洞

Description

Here is an exploit in python to exploit the CVE-2024-24590, which is an upload pickle in a ClearML, which leads to arbitrary code execution... Enjoy :D

介绍

## How it works-
### Need access to the team work space

Replace **IP** and **PORT** to your listener port and IP

Change the project name to an existing project name.

**IMPORTANT... YOU MIGHT NEED TO UPLOAD IT A COUPLE OF TIMES (RUN THE EXPLOIT A COUPLE OF TIMES)...**

@lrdvile on x

thank me later :D

## example of use

1. click on start new project on clearml
2. install clearml on terminal with pip
3. get the creds from clearml web (gen creds from clicking new project)
4. clearml-init in ur terminal and paste in the creds
5. nc -lnvp 4444
6. python exploit.py



reference:
https://hiddenlayer.com/research/not-so-clear-how-mlops-solutions-can-muddy-the-waters-of-your-supply-chain/

文件快照

备注