Description

Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-04T15:17:43.947Z",
  "pubdate": "2026-09-04T15:17:43.947Z",
  "executiveSummary": "The Aim remote tracking server (version 3.29.1) contains a critical authentication bypass and insecure method invocation vulnerability. The vulnerability stems from the application's failure to perform authentication on incoming requests, combined with an unsafe use of the getattr() function to dispatch method calls without an allowlist.\nThis flaw allows unauthenticated remote attackers to interact with the Aim server, register arbitrary clients, and instantiate internal Repo resources. By leveraging the dynamic method dispatch mechanism, an attacker can invoke unauthorized operations, leading to the unauthorized disclosure of experiment data or the destructive deletion of production runs.\nThe risk is severe as it grants full unauthorized control over the tracking infrastructure. No authentication is required for exploitation, and the attack vector is exposed over the network, potentially compromising the integrity and confidentiality of sensitive machine learning metadata and experiment logs.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of request validation within the Aim remote tracking server. The application exposes a service endpoint that fails to verify the identity of the requester before processing requests. Consequently, the server accepts administrative-level commands from unauthenticated sources.\nThe core of the vulnerability lies in the use of the Python getattr() function to dynamically dispatch methods based on user-supplied input without an associated allowlist or strict validation logic. In Python, getattr() allows an object's attributes—including its methods—to be accessed and executed by string name. When the server parses an incoming request, it maps user-supplied strings directly to internal object methods. Because there is no check to restrict which methods can be invoked, an attacker can specify arbitrary method names that the application object possesses.\nThe attack flow proceeds as follows: First, an attacker establishes a network connection to the Aim remote tracking server. Second, the attacker sends a crafted request payload designed to bypass the absent authentication gate. Third, the attacker interacts with the server's API to initiate client registration. Fourth, by injecting specific method names into the request, the attacker directs the server to instantiate a Repo resource. Once the Repo object is instantiated, the attacker can use the dynamic dispatch mechanism to call methods associated with that object. For example, by specifying the appropriate method string, the attacker can execute functions designed to retrieve experiment data or trigger destructive actions such as deleting runs.\nThe impact is significant due to the nature of Aim as an experiment tracking tool. Successful exploitation allows for the full exposure of research data, which may contain sensitive parameters, model architecture details, or training metrics. Furthermore, the ability to delete runs constitutes a permanent loss of experiment history, impacting reproducibility and audit trails. The lack of an allowlist around the dispatch logic effectively turns the server into an arbitrary execution proxy for any method available within the scope of the exposed service object."
}