Directory Traversal in stitionai/devika

Successful exploitation of CVE-2024-5547 allows an attacker to bypass intended directory restrictions and download arbitrary PDF files. This could expose sensitive data contained within those files, such as confidential documents, financial records, or proprietary information. The potential impact extends beyond simple data exposure; an attacker could potentially use this vulnerability to gain a deeper understanding of the system's file structure and identify other potential vulnerabilities. While the initial access point is limited to the /api/download-project-pdf endpoint, the ability to download arbitrary files could facilitate further reconnaissance and lateral movement within the affected environment.

Organizations utilizing the stitionai/devika project, particularly those deploying it in production environments without proper security hardening, are at risk. Shared hosting environments where multiple users share the same server are also particularly vulnerable, as an attacker could potentially access PDF files belonging to other users.

• linux / server:

journalctl -u devika -f | grep "download_project_pdf"

• generic web:

curl -I 'http://your-devika-server/api/download-project-pdf?project_name=../../../../etc/passwd' | grep 'HTTP/1.1' # Check for 403 or 200 OK

1. 2024-06-27Disclosure

   disclosure

1. Reserviert2024-05-30
2. Veröffentlicht2024-06-27
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

Due to the absence of a direct patch, mitigation strategies focus on limiting the vulnerability's impact. The primary mitigation is to implement robust input validation on the project_name parameter within the /api/download-project-pdf endpoint. This should include strict whitelisting of allowed characters and regular expression-based validation to prevent directory traversal sequences (e.g., ../). Additionally, implement strict access controls to restrict access to the directory containing the PDF files. Consider deploying a Web Application Firewall (WAF) with rules to detect and block requests containing suspicious directory traversal patterns. Regularly review and audit the application's code for similar vulnerabilities.