CVE-2024-5547

Executive Summary

CVE-2024-5547 is a directory traversal vulnerability in the Stitionai Devika project, specifically in the /api/download-project-pdf endpoint. The flaw allows an unauthenticated attacker to read arbitrary PDF files from the server filesystem by manipulating the project_name parameter. With a CVSS score of 7.5 (High), this vulnerability poses a significant risk to confidentiality, as sensitive PDF documents outside the intended directory can be exfiltrated. No patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains due to the simplicity of the attack.

Supply Chain & Package Security

This vulnerability affects the Stitionai Devika repository, which is a Python-based project. While no specific package manager (NPM, PyPI, Go, Ruby) is directly implicated, the project is distributed via GitHub and may be installed via pip or Docker. Users should verify the integrity of their Devika installation and monitor for any malicious packages that may attempt to exploit this path traversal.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Sensitive PDF files can be read.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High – The vulnerability is easy to exploit and can lead to significant data leakage.

Deep Dive & Mechanics

The vulnerability resides in the download_project_pdf function within the /api/download-project-pdf endpoint. The project_name parameter is used to construct a file path without proper sanitization. An attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and access arbitrary PDF files on the system.

Root Cause: Insufficient input validation – the application does not strip or reject path traversal characters from the project_name parameter.

Attack Flow:

1. Attacker sends a GET request to /api/download-project-pdf?project_name=../../etc/passwd (or similar).
2. The server constructs a file path like /app/projects/../../etc/passwd.pdf (or similar).
3. If the file exists and is a PDF (or the server does not enforce extension), the file is returned.

Impact: Unauthorized access to sensitive PDF documents, including configuration files, credentials, or proprietary data stored in PDF format.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

@app.route('/api/download-project-pdf')
def download_project_pdf():
    project_name = request.args.get('project_name')
    file_path = f"/app/projects/{project_name}.pdf"
    return send_file(file_path)

Patched Code (Conceptual):

import os

@app.route('/api/download-project-pdf')
def download_project_pdf():
    project_name = request.args.get('project_name')
    # Sanitize: remove path traversal sequences
    safe_name = os.path.basename(project_name)
    file_path = f"/app/projects/{safe_name}.pdf"
    if not os.path.exists(file_path):
        abort(404)
    return send_file(file_path)

Key Differences:

• The patched version uses os.path.basename() to strip directory components.
• It also checks file existence before sending.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Stitionai Devika (latest version).
• Network access to the /api/download-project-pdf endpoint.

Exploit Steps:

1. Identify the target endpoint: http://target:5000/api/download-project-pdf
2. Craft a request with path traversal:

   GET /api/download-project-pdf?project_name=../../etc/passwd HTTP/1.1
   Host: target:5000
   

3. If the server returns a PDF, the file is accessible. For non-PDF files, the server may return an error or the file content.

Example using curl:

curl -v "http://target:5000/api/download-project-pdf?project_name=../../etc/passwd"

Note: The server may append .pdf to the path, so the actual file must be a PDF or the server must not enforce the extension.

Blue Team

Detection:

• Monitor for GET requests to /api/download-project-pdf with suspicious project_name parameters containing ../ or ..\\.
• Look for unusual file paths in logs (e.g., /etc/passwd.pdf).

Hunting:

• Search web server logs for patterns like project_name=\.\./ or project_name=%2e%2e%2f.
• Check for outbound connections from the Devika server to unknown IPs (data exfiltration).

Mitigation:

• Apply input validation as shown in the patched code.
• Restrict file access permissions on the server.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /api/download-project-pdf with project_name containing ../ or ..\\.
  • Unusual file paths in the project_name parameter (e.g., /etc/passwd, /var/log/syslog).
• File System:
  • Unexpected PDF files in the project directory.
  • Access logs showing attempts to read files outside the intended directory.
• Logs:
  • Web server logs with 200 responses to path traversal requests.
  • Error logs indicating file not found for paths like /etc/passwd.pdf.

Detection Engineering

YARA Rule

rule CVE_2024_5547_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in HTTP requests to /api/download-project-pdf"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5547"
    strings:
        $traversal1 = "project_name=../"
        $traversal2 = "project_name=..\\"
        $traversal3 = "project_name=%2e%2e%2f"
        $traversal4 = "project_name=%2e%2e\\"
        $endpoint = "/api/download-project-pdf"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2024-5547 Directory Traversal in Devika
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects directory traversal attempts against the /api/download-project-pdf endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5547
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/download-project-pdf'
        cs-uri-query|contains: 
            - 'project_name=../'
            - 'project_name=..\\'
            - 'project_name=%2e%2e%2f'
            - 'project_name=%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate use of project names with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5547 Directory Traversal in Devika"; flow:to_server; content:"GET"; http_method; content:"/api/download-project-pdf"; http_uri; content:"project_name="; http_uri; pcre:"/project_name=[^&]*(\.\.\/|\.\.\\)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict sanitization of the project_name parameter using os.path.basename() or similar.
2. Access Controls: Restrict file system permissions so the application can only read files within the intended directory.
3. WAF Rules: Deploy a Web Application Firewall to block path traversal patterns.

Long-Term Fixes:

• Patch: Await an official patch from Stitionai. Monitor the GitHub repository for updates.
• Code Review: Conduct a security audit of all endpoints handling file paths.
• Least Privilege: Run the application with minimal file system permissions.

Workarounds:

• Disable the /api/download-project-pdf endpoint if not needed.
• Use a reverse proxy to filter requests.

Valters IT
Securing Digital Frontiers