PT-2025-12235 · Modelscope · Agentscope

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-8537

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions modelscope/agentscope versions all

Description The issue is related to a path traversal problem in the application. It is present in the "/delete-workflow" endpoint, which allows an attacker to delete arbitrary files from the filesystem. This problem arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.

Recommendations For all versions, consider disabling access to the "/delete-workflow" endpoint until a proper fix is applied, and ensure proper input validation is implemented to prevent path manipulation. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-29

Related Identifiers

CVE-2024-8537

GHSA-C4CC-W454-4634

Affected Products

Agentscope

References · 8

• 🔥 https://huntr.com/bounties/eeb8aa4b-e6e5-465c-b0dd-aa97e3b7dc09 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8537 · Security Note
• https://osv.dev/vulnerability/GHSA-c4cc-w454-4634 · Vendor Advisory
• https://github.com/modelscope/agentscope/blob/01530ee6a99c86426aab1be11ec3b3b86ca640ac/src/agentscope/studio/_app.py#L743 · Note
• https://github.com/modelscope/agentscope/commit/7d285e862f86fa1d96ed04c4cd40a5f1b8f9189a · Note
• https://github.com/modelscope/agentscope · Note
• https://github.com/modelscope/agentscope/pull/459 · Note
• https://twitter.com/CVEnew/status/1902671039999418725 · Twitter Post