Directory Traversal in stitionai/devika

The primary impact of CVE-2024-5548 is unauthorized access to sensitive files stored on the server. By manipulating the 'project_name' parameter in a GET request to the /api/download-project endpoint, an attacker can traverse the directory structure and download files outside the intended directory. This could expose configuration files, source code, database credentials, or other confidential data. The blast radius is potentially significant, depending on the files accessible and the privileges of the user running the devika application. Successful exploitation could lead to data breaches, system compromise, and further malicious activity.

Organizations deploying Devika in environments with inadequate input validation or access controls are at risk. Shared hosting environments where multiple users share the same server are particularly vulnerable, as an attacker could potentially compromise other users' data through this vulnerability. Systems with legacy configurations or those lacking robust security monitoring are also at increased risk.

• linux / server: Monitor access logs for requests to /api/download-project containing suspicious characters like ../ or absolute paths. Use grep to search for these patterns.

grep 'project_name=.*\.\.' /var/log/nginx/access.log

• generic web: Use curl to test the endpoint with various payloads containing path traversal sequences.

curl 'http://your-devika-server/api/download-project?project_name=../../../../etc/passwd'

• generic web: Examine response headers for unexpected content types or file extensions that indicate unauthorized file access. • linux / server: Use auditd to monitor access to sensitive files and directories. Create an audit rule to log attempts to access files outside the intended directory.

auditctl -w / -p wa -k devika_traversal

1. 2024-06-27Disclosure

   disclosure

1. Reserviert2024-05-30
2. Veröffentlicht2024-06-27
3. Geändert2024-08-01
4. EPSS aktualisiert2026-04-02

Due to the absence of a direct patch (fixedin is unavailable), immediate mitigation focuses on restricting access and validating input. Implement strict input validation on the 'projectname' parameter, ensuring it only contains expected characters and does not include path traversal sequences (e.g., '..'). Consider using a whitelist approach, only allowing specific, known project names. Restrict file access permissions to the devika application user, limiting its ability to read files outside of the intended project directory. Web application firewalls (WAFs) can be configured to detect and block requests containing suspicious path traversal patterns. Regularly review and audit the application's code and configuration to identify and address potential vulnerabilities. After implementing these mitigations, verify functionality by attempting to access files outside the intended directory with various path traversal payloads.