DoS vulnerability in Applio restart.py via arbitrary process termination
Applio version 3.2.7 is vulnerable to denial of service through a flaw in restart.py where user input for model_name is used unsanitized to construct file paths and access process IDs for termination. An attacker can exploit path traversal and arbitrary file writes to kill critical processes and crash the application.
What happened
The stop_train function in restart.py takes user input for model_name without sanitization and uses it to construct a file path to access config.json.
An attacker can use path traversal (e.g., supplying "../../" in model_name) to read process IDs from config.json files in arbitrary locations, or combine this with arbitrary file writes to plant a config.json containing hundreds of attacker-controlled process IDs.
When the vulnerable endpoint is accessed, the function reads these process IDs and terminates them using os.kill, potentially killing the Applio process itself or other critical processes on the system.
Reported impact
The vulnerability enables denial of service by allowing an attacker to terminate critical processes and crash the Applio application.
Index analysis
The root cause is the use of unsanitized user input (model_name) in os.path.join to construct file paths, enabling both path traversal and arbitrary process termination.
The broad exception handling (except: pass) masks errors and allows the attack to proceed silently.
Governance controls
GitHub Security Lab reported the vulnerability to the Applio maintainers on 2024-12-11 and conducted a coordinated disclosure process over three months, with multiple follow-ups.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.