AVID-2026-R1411

Description

Remote code execution (CVE-2024-21649)

Details

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.

Reason for inclusion in AVID: CVE-2024-21649 describes a remote code execution vulnerability in the vantage6 platform (pre-4.2.0) that can be exploited via algorithm environment variables. Vantage6 is an AI tooling/platform used to manage and deploy federated learning and MPC workflows, i.e., software used in AI pipelines. This is a software vulnerability affecting a component used to build/deploy AI systems, not hardware/firmware. It is a security vulnerability with high impact (RCE) and has a published patch. Therefore it should be kept for AVID curation as a general-purpose AI software supply chain vulnerability.

References

Affected or Relevant Artifacts

Developer: vantage6
Deployer: vantage6
Artifact Details:

Type	Name
System	vantage6

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score	8.8
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-94	CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-01-30
Version: 0.3.3
AVID Entry