stitionai/devika におけるローカルファイルインクルージョン

The primary impact of CVE-2024-6433 is the unauthorized disclosure of sensitive files on the system. An attacker can exploit this vulnerability by crafting a malicious request that includes a specially crafted snapshot_path parameter. This parameter directs the application to zip files, but the attacker can control the path, allowing them to specify arbitrary files for reading. The potential data at risk includes configuration files, source code, database credentials, and any other files accessible by the application's user account. Lateral movement is unlikely directly from this vulnerability, but the exposed data could be used to compromise other systems or accounts.

Organizations deploying devika in environments where user input directly influences file access are at risk. This includes deployments with weak input validation or where the application's user account has excessive permissions. Shared hosting environments where multiple users share the same devika instance are also particularly vulnerable.

• python / server:

  grep -r 'snapshot_path=' /path/to/devika/source_code

• generic web:

  curl -I 'http://your-devika-instance/zip?snapshot_path=../../../../etc/passwd'  # Check for 200 OK response

1. 2024-07-10Disclosure

   disclosure

1. 予約済み2024-07-01
2. 公開日2024-07-10
3. 更新日2024-08-01
4. EPSS 更新日2026-04-02

Due to the absence of a fixed version, immediate mitigation focuses on restricting access and validating user input. Implement strict input validation on the snapshotpath parameter, ensuring it only accepts expected values and paths. Consider using a whitelist of allowed directories instead of a blacklist. Restrict the application's user account to the minimum necessary permissions to prevent access to sensitive files. Implement a Web Application Firewall (WAF) rule to block requests containing suspicious characters or paths in the snapshotpath parameter. Regularly review application logs for any unusual activity related to file access.