FishAudio Bert-VITS2 up to 2.3 resample data_dir os command injection

Summaryinfo

A vulnerability labeled as critical has been found in FishAudio Bert-VITS2 up to 2.3. Affected by this issue is the function resample. Such manipulation of the argument data_dir leads to os command injection. This vulnerability is referenced as CVE-2024-39685. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in FishAudio Bert-VITS2 up to 2.3. It has been rated as very critical. Affected by this issue is the function resample. The manipulation of the argument data_dir with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is used directly in a command executed with subprocess.run(cmd, shell=True) in the resample function, which leads to arbitrary command execution. This affects fishaudio/Bert-VITS2 2.3 and earlier.

The advisory is shared for download at securitylab.github.com. This vulnerability is handled as CVE-2024-39685 since 06/27/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 09/12/2024). The MITRE ATT&CK project declares the attack technique as T1202.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• FishAudio

Name

• Bert-VITS2

Version

• 2.0
• 2.1
• 2.2
• 2.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion