PT-2024-32455 · Agnai · Agnai

Noe233 + 1 · Published 2024-09-26 · Updated 2024-10-30 · CVE-2024-47171

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Agnai versions prior to 1.0.330

Description A vulnerability in Agnai permits attackers to upload image files at attacker-chosen locations on the server. This issue can lead to image file uploads to unauthorized or unintended directories, including overwriting of existing images which may be used for defacement. The vulnerability does not affect agnai.chat, installations using S3-compatible storage, or self-hosting that is not publicly exposed. The issue is a path traversal vulnerability, where an attacker can exploit it by sending a specially crafted request to the editCharacter handler, allowing them to manipulate the path where the file is uploaded to. The id variable is string interpolated into filename without path normalization, enabling attackers to freely manipulate the upload path.

Recommendations For versions prior to 1.0.330, update to version 1.0.330 to fix the vulnerability. As a temporary workaround, consider restricting access to the entityUpload function or disabling the upload functionality until a patch is available. Additionally, restrict access to the /api/character/ endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-35

Related Identifiers

CVE-2024-47171

GHSA-G54F-66MW-HV66

Affected Products

Agnai

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47171.json · Exploit
• https://github.com/agnaistic/agnai/security/advisories/GHSA-g54f-66mw-hv66 · Vendor Advisory
• https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/character.ts#L140: · Patch
• https://github.com/agnaistic/agnai/blob/75abbd5b0f5e48ddecc805365cf1574d05ee1ce5/srv/api/upload.ts#L55 · Patch
• https://osv.dev/vulnerability/GHSA-g54f-66mw-hv66 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47171 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47171 · Vendor Advisory
• https://github.com/agnaistic/agnai · Note
• https://twitter.com/transilienceai/status/1843836972608934323 · Twitter Post
• https://t.me/cvedetector/6439 · Telegram Post
• https://t.me/cvenotify/100076 · Telegram Post
• https://twitter.com/transilienceai/status/1845455353095520730 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1839417270172365024 · Twitter Post
• https://twitter.com/CVEnew/status/1839358137046106204 · Twitter Post