Marimo, Unauthenticated Internal Service Proxy, CVE-2024-50360 (Critical)

Listen to this Post

🐢▶️ Listen🚀

The vulnerability exists in the `/mpl//` endpoint within the `marimo/_server/main.py` source file. This endpoint is designed as an internal, unauthenticated proxy to facilitate interactive matplotlib visualizations by routing traffic to a specified local port and route. However, because it lacks any access controls, an external attacker can exploit it to relay HTTP, WebSocket, or ASGI requests to any service running on the server’s localhost. By crafting a URL like `http://target-server/mpl/8080/admin`, an attacker can force the Marimo server to connect to an internal service on port 8080 at the `/admin` path. This effectively bypasses network security controls like firewalls that are intended to restrict access to these internal services, exposing them to the internet. The impact is direct and severe, as it allows attackers to interact with back-end services as if they were running locally on the Marimo instance.
Platform: Marimo
Version: Pre-0.8.0
Vulnerability: Unauthenticated Proxy
Severity: Critical

date: 2024-10-24

Prediction: Patch 2024-11-07

What Undercode Say:

curl -v http://victim.com/mpl/8080/admin
nmap --script http-vuln-cve2024-50360 -p 80 victim.com
shodan search http.favicon.hash:marimo

PoC to check for vulnerable endpoint
import requests
target = "http://example.com"
port = "8080"
route = "admin"
response = requests.get(f"{target}/mpl/{port}/{route}")
print(response.status_code)

How Exploit:

Attacker crafts malicious URL.

Server proxies request internally.

Access to local services granted.

Bypasses firewall restrictions.

Leads to data exfiltration.

Protection from this CVE

Disable the /mpl endpoint.

Implement authentication checks.

Restrict server to localhost.

Update to patched version.

Use network segmentation.

Impact:

Full internal network access.

Remote code execution possible.

Sensitive data exposure.

Bypasses security perimeters.

Widespread cloud instances affected.

🎯Let’s Practice Exploiting & Learn Patching For Free:

Sources:

Reported By: github.com
Extra Source Hub:
Undercode

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow DailyCVE & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin