stitionai/devika 中的目录遍历漏洞

该目录遍历漏洞允许攻击者绕过访问控制，读取服务器上的任意文件。攻击者可以利用此漏洞获取敏感信息，例如配置文件、数据库凭证、源代码或其他机密数据。攻击者可能通过该漏洞获取系统内部信息，进行进一步的攻击，例如横向移动到其他系统或执行恶意代码。由于该漏洞影响文件下载功能，攻击者可能能够下载包含恶意代码的文件，并在受害者设备上执行。

Organizations deploying Devika in environments with inadequate input validation or access controls are at risk. Shared hosting environments where multiple users share the same server are particularly vulnerable, as an attacker could potentially compromise other users' data through this vulnerability. Systems with legacy configurations or those lacking robust security monitoring are also at increased risk.

• linux / server: Monitor access logs for requests to /api/download-project containing suspicious characters like ../ or absolute paths. Use grep to search for these patterns.

grep 'project_name=.*\.\.' /var/log/nginx/access.log

• generic web: Use curl to test the endpoint with various payloads containing path traversal sequences.

curl 'http://your-devika-server/api/download-project?project_name=../../../../etc/passwd'

• generic web: Examine response headers for unexpected content types or file extensions that indicate unauthorized file access. • linux / server: Use auditd to monitor access to sensitive files and directories. Create an audit rule to log attempts to access files outside the intended directory.

auditctl -w / -p wa -k devika_traversal

1. 2024-06-27Disclosure

   disclosure

1. 已保留2024-05-30
2. 发布日期2024-06-27
3. 修改日期2024-08-01
4. EPSS 更新日期2026-04-02

由于目前尚未发布官方补丁，缓解措施应侧重于限制攻击面和加强输入验证。首先，建议禁用或限制对 /api/download-project 接口的访问。其次，实施严格的输入验证，确保 'project_name' 参数只接受预期的值，并拒绝包含特殊字符或路径遍历序列的输入。可以使用 Web 应用防火墙 (WAF) 或代理服务器来过滤恶意请求。此外，定期审查和更新 devika 仓库的代码，以识别和修复潜在的安全漏洞。