{"id":"CVE-2024-47170","aliases":[],"url":"https://o3.security/vulnerability/CVE-2024-47170","summary":"Agnai File Disclosure Vulnerability: JSON via Path Traversal ","details":"### CWE-35: Path Traversal\n\nhttps://cwe.mitre.org/data/definitions/35.html\n\n### CVSSv3.1 4.3 - Medium\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\n### Summary\n\nA vulnerability has been discovered in **Agnai** that permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files.\n**This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only.**\n\n### Details & PoC\n\nThis is a path traversal vulnerability. An attacker can exploit this vulnerability by sending a specially crafted request:\n\n```tsx\nGET /api/json/messages/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%61%70%70%2fpackage HTTP/1.1\n```\n\nIn this example, the attacker retrieves the `package.json` file content from the server by manipulating the file path.\n\nThe request is processed by the `loadMessages` handler in `agnai/srv/api/json/index.ts` and a file is read and returned to the client. The read filename is constructed using string interpolation, with no guard or check for path traversal: https://github.com/agnaistic/agnai/blob/2b878b7ca66471c5dd080197ad9ca2f7f0022655/srv/api/json/index.ts#L77\n\n#### Constraints\n\nEnvironment constraints: JSON Storage enabled (non standard)\n\n### Impact\n\nThis vulnerability is classified as a path traversal vulnerability. Specifically, any JSON file on the server which the webserver process has read privileges for, can be disclosed to the attacker.\n\n### Credit\n- @ropwareJB\n- @noe233","published":"2024-09-26T18:07:52Z","modified":"2024-09-26T21:11:05Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"agnai","fixedVersion":"1.0.330"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47170"},{"type":"PACKAGE","url":"https://github.com/agnaistic/agnai"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2024-09-26T21:11:05Z"}}