devika
devika copied to clipboard
stitionai
[Security Bug] Path Traversal Vulnerability in the API.
Describe the bug
When performing static code analysis, if a parameter received in the API is forwarded directly to the user without validation, a critical vulnerability arises.In the Devika.py file, the /api/get-browser-snapshot endpoint takes the query from the request and sends the specified file to the user. Since there is no filtering or additional validation, any file can be sent to the user.
PoC
The vulnerability arises as you can see from below.
- Vulnerable Endpoint: localhost:1337/api/get-browser-snapshot?snapshot_path=
- Payload: ../../../../../../etc/passwd
Url:
File Content:
Vulnerable Code Snippet:
Mitigation
- https://owasp.org/www-community/attacks/Path_Traversal
- https://brightsec.com/blog/directory-traversal-mitigation/
- https://portswigger.net/web-security/file-path-traversal
Hey @slash0x99 , I already submitted that issue and also created a pull request for it but no response! I assume they abounded the project.
CVE-2024-40422
