---
cve: "CVE-2024-5452"
severity: "CRITICAL"
cvss: 9.8
epss: "26.8%"
vendor: "lightning-ai"
kev: false
exploited: false
published: "2024-06-06 18:15:20"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-01T14:04:19+01:00"
---

# CVE-2024-5452

> 9.8 CRITICAL · 🧪 PoC

## Beschreibung

A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.

## CNA-Record (Kanon, cvelistV5)

- CNA: **@huntr_ai**
- State: PUBLISHED
- Stand: 2025-10-15 12:50:27
- CNA-CVSS: **9.8** (`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-915** — Improperly Controlled Modification of Dynamically-Determined Object Attributes
  The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

## Patch verfügbar (OSV)

- cf348673eda662cc2e9aa71a72a19b8774f85718 (Commit)
- 330af381de88cff17515418a341cbc1f9f127f9a (Commit)

## BSI-Hinweise (deutsch)

- [PyTorch: Schwachstelle ermöglicht Codeausführung](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2024-1329) — _BSI-Einstufung: kritisch_
  Ein entfernter, anonymer Angreifer kann eine Schwachstelle in PyTorch ausnutzen, um beliebigen Programmcode auszuführen.

## Referenzen

- <https://huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da>
- <https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-5452/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_