Ptechhub
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs
No Result
View All Result
PtechHub
No Result
View All Result

Lightning AI Studio Vulnerability Allowed RCE via Hidden URL Parameter

The Hacker News by The Hacker News
January 30, 2025
Home Cybersecurity
Share on FacebookShare on Twitter


Jan 30, 2025Ravie LakshmananVulnerability / Cloud Security

Cybersecurity researchers have disclosed a critical security flaw in the Lightning AI Studio development platform that, if successfully exploited, could allow for remote code execution.

The vulnerability, rated a CVSS score of 9.4, enables “attackers to potentially execute arbitrary commands with root privileges” by exploiting a hidden URL parameter, application security firm Noma said in a report shared with The Hacker News.

“This level of access could hypothetically be leveraged for a range of malicious activities, including the extraction of sensitive keys from targeted accounts,” researchers Sasi Levi, Alon Tron, and Gal Moyal said.

The issue is embedded in a piece of JavaScript code that could facilitate unfettered access to a victim’s development environment, as well as run arbitrary commands on an authenticated target in a privileged context.

Noma said it found a hidden parameter called “command” in user-specific URLs – e.g., “lightning.ai/PROFILE_USERNAME/vision-model/studios/STUDIO_PATH/terminal?fullScreen=true&commmand=cmVzc…” – which could be used to pass a Base64-encoded instruction to be executed on the underlying host.

Cybersecurity

Even worse, the loophole could be weaponized to run commands that can exfiltrate critical information such as access tokens and user information to an attacker-controlled server.

Successful exploitation of the vulnerability means that it could permit an adversary to execute arbitrary privileged commands and gain root access, harvest sensitive data, and manipulate the file system to create, delete, or modify files on the server.

Lightning AI Studio Vulnerability

All an attacker needs to pull this off is prior knowledge of a profile username and their associated Lightning AI Studio, details that are publicly available via the Studio templates gallery.

Armed with this information, the threat actor can then craft a malicious link such that it triggers code execution on the identified Studio under root permissions. Following responsible disclosure on October 14, 2024, the problem has been resolved by the Lightning AI team as of October 25.

“Vulnerabilities like these underscore the importance of mapping and securing the tools and systems used for building, training, and deploying AI models because of their sensitive nature,” the researchers said.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
The Hacker News

The Hacker News

Next Post
Your Pizza Guy Is Now AI

Your Pizza Guy Is Now AI

Recommended.

ServiceNow Launches Significant AI Agent Expansion, Reports Annual Growth

ServiceNow Launches Significant AI Agent Expansion, Reports Annual Growth

January 29, 2025
Kroger turns to AI for inventory security, experience boosts

Kroger turns to AI for inventory security, experience boosts

July 9, 2025

Trending.

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More

October 6, 2025
Cloud Computing on the Rise: Market Projected to Reach .6 Trillion by 2030

Cloud Computing on the Rise: Market Projected to Reach $1.6 Trillion by 2030

August 1, 2025
Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

Stocks making the biggest moves midday: Autodesk, PayPal, Rivian, Nebius, Waters and more

July 14, 2025
The Ultimate MSP Guide to Structuring and Selling vCISO Services

The Ultimate MSP Guide to Structuring and Selling vCISO Services

February 19, 2025
Translators’ Voices: China shares technological achievements with the world for mutual benefit

Translators’ Voices: China shares technological achievements with the world for mutual benefit

June 3, 2025

PTechHub

A tech news platform delivering fresh perspectives, critical insights, and in-depth reporting — beyond the buzz. We cover innovation, policy, and digital culture with clarity, independence, and a sharp editorial edge.

Follow Us

Industries

  • AI & ML
  • Cybersecurity
  • Enterprise IT
  • Finance
  • Telco

Navigation

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Subscribe to Our Newsletter

  • About
  • Advertise
  • Privacy & Policy
  • Contact

Copyright © 2025 | Powered By Porpholio

No Result
View All Result
  • News
  • Industries
    • Enterprise IT
    • AI & ML
    • Cybersecurity
    • Finance
    • Telco
  • Brand Hub
    • Lifesight
  • Blogs

Copyright © 2025 | Powered By Porpholio