Pfadüberschreitung in transformeroptimus/superagi

The primary impact of CVE-2024-9415 is the ability for an attacker to upload arbitrary files to the SuperAGI server. This is a significant risk because the attacker can potentially upload malicious code (e.g., a web shell) that grants them remote code execution. Beyond RCE, an attacker could overwrite configuration files, database files, or other sensitive data, leading to data breaches, denial of service, or complete system compromise. The blast radius extends to any data processed or stored by SuperAGI, and the potential for lateral movement within the network depends on the server's access privileges and network configuration. This vulnerability shares similarities with other path traversal exploits where attackers leverage predictable file system structures to gain unauthorized access.

Organizations deploying SuperAGI, particularly those using the 0.0.14 version or earlier, are at risk. Shared hosting environments where SuperAGI is deployed alongside other applications are particularly vulnerable, as a successful exploit could potentially compromise other tenants on the same server. Users who have not implemented robust file upload validation and access controls are also at increased risk.

• python / server:

import os
import glob

# Check for unusual files in the upload directory
upload_dir = '/path/to/superagi/uploads/'
for file in glob.glob(upload_dir + '*'):
    if '..' in file or '../' in file:
        print(f'Potential Path Traversal: {file}')

• linux / server:

# Check for files outside the intended upload directory
find /path/to/superagi/uploads/ -type f -not -path '/path/to/superagi/uploads/*'

• generic web:

curl -I 'http://your-superagi-server/uploads/../../../../etc/passwd' # Check for directory traversal attempts

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-10-01
2. Veröffentlicht2025-03-20
3. EPSS aktualisiert2026-04-02

The most effective mitigation for CVE-2024-9415 is to upgrade to a patched version of SuperAGI as soon as it becomes available. Until a patch is available, implement strict file upload validation on the server-side. This includes whitelisting allowed file extensions, validating file sizes, and sanitizing filenames to prevent directory traversal characters (e.g., '..'). Restrict the writable directories accessible to the SuperAGI application to only those necessary for its operation. Consider implementing a Web Application Firewall (WAF) with rules to detect and block path traversal attempts. Regularly review file system permissions to ensure that SuperAGI has only the minimum necessary access.