CVE-2025-51475

Executive Summary

CVE-2025-51475 is a critical Arbitrary File Overwrite (AFO) vulnerability discovered in TransformerOptimus SuperAGI version 0.0.14. The flaw resides in the superagi.controllers.resources.upload endpoint, where unsanitized filenames submitted during file upload allow remote attackers to perform directory traversal attacks. Due to improper handling of os.path.join() and a lack of path validation in get_root_input_dir(), an attacker can overwrite arbitrary files on the server filesystem. This can lead to remote code execution (RCE) by overwriting critical application files (e.g., Python modules, configuration files) or system binaries. The vulnerability is unpatched as of the latest advisory, and a proof-of-concept (PoC) is publicly available.

Supply Chain & Package Security

SuperAGI is a Python-based open-source project distributed via PyPI. The vulnerable package superagi version 0.0.14 is affected. Organizations using this package in their supply chain should immediately assess their exposure. The lack of a patch means that any deployment of SuperAGI 0.0.14 is at risk. The vulnerability is introduced through the os.path.join() function, which is a standard Python library function, but the misuse of it (without proper sanitization) creates the flaw. No malicious package substitution has been reported, but the risk of supply chain compromise via this vulnerability is high if an attacker can upload a malicious file that overwrites a legitimate package file.

CVSS Breakdown & Threat Level

CVSS Score: 9.1 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to trigger the upload.
• User Interaction (UI): None – The attacker does not need to trick a legitimate user.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): None – The primary impact is on integrity and availability, not confidentiality.
• Integrity (I): High – Arbitrary file overwrite can lead to complete system compromise.
• Availability (A): High – Overwriting critical files can cause denial of service.

Threat Level: Critical. The vulnerability is trivial to exploit (no authentication, low complexity) and can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability is located in the file upload functionality of SuperAGI, specifically in the superagi/controllers/resources.py module. The endpoint /upload accepts file uploads and processes them using the upload function. The core issue is in how the destination path is constructed:

# Vulnerable code snippet (simplified)
import os

def get_root_input_dir():
    # Returns a base directory, e.g., "/app/input"
    return "/app/input"

def upload(file):
    root_dir = get_root_input_dir()
    # The filename is taken directly from the user without sanitization
    filename = file.filename  # e.g., "../../etc/passwd"
    # os.path.join() is used to construct the full path
    full_path = os.path.join(root_dir, filename)
    # The file is saved to full_path
    file.save(full_path)

The os.path.join() function in Python does not prevent directory traversal. If filename contains ../ sequences, os.path.join() will resolve them, allowing the file to be written outside the intended root_dir. For example, if root_dir is /app/input and filename is ../../etc/cron.d/malicious, the resulting full_path becomes /etc/cron.d/malicious, enabling the attacker to overwrite system files.

The get_root_input_dir() function does not perform any validation to ensure that the final path is within the allowed directory. This lack of path normalization and validation is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (SuperAGI 0.0.14):

# superagi/controllers/resources.py (vulnerable)
import os

def get_root_input_dir():
    return "/app/input"

def upload(file):
    root_dir = get_root_input_dir()
    filename = file.filename
    full_path = os.path.join(root_dir, filename)
    # No validation of full_path
    file.save(full_path)

Patched Code (Hypothetical fix):

# superagi/controllers/resources.py (patched)
import os

def get_root_input_dir():
    return "/app/input"

def upload(file):
    root_dir = get_root_input_dir()
    filename = file.filename
    # Sanitize filename: remove any path components
    safe_filename = os.path.basename(filename)
    full_path = os.path.join(root_dir, safe_filename)
    # Validate that the final path is within root_dir
    real_root = os.path.realpath(root_dir)
    real_full = os.path.realpath(full_path)
    if not real_full.startswith(real_root + os.sep):
        raise ValueError("Invalid file path")
    file.save(full_path)

The patched code uses os.path.basename() to strip any directory components from the filename, ensuring only the filename itself is used. Additionally, it uses os.path.realpath() to resolve any symlinks or .. sequences and then checks that the resolved path starts with the resolved root directory. This prevents any traversal outside the intended directory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of SuperAGI 0.0.14 with the file upload endpoint exposed.
• Network access to the /upload endpoint.

Exploit Steps:

1. Identify the upload endpoint: Typically http://target:port/upload (POST request).
2. Craft a malicious filename: Use directory traversal to target a critical file. For example, to overwrite the application's main configuration file:
   • Filename: ../../app/config.py
3. Prepare the payload: Create a Python file that contains malicious code (e.g., a reverse shell).
4. Send the request:

   curl -X POST http://target:8080/upload \
     -F "file=@malicious.py;filename=../../app/config.py"
   

5. Trigger execution: If the overwritten file is imported or executed by the application (e.g., on restart or on next request), the attacker gains code execution.

Alternative target: Overwrite a cron job or systemd service file for persistence.

Blue Team (Defense & Detection)

Detection:

• Monitor file system events for writes to unexpected locations (e.g., /etc/, /app/ outside the upload directory).
• Look for HTTP requests with filenames containing ../ or ..\\ sequences.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately isolate any SuperAGI 0.0.14 instances.
• Apply the hypothetical patch or implement a WAF rule to block directory traversal patterns in file uploads.
• Restrict the application's write permissions to only the necessary directories.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /upload with filenames containing ../ or ..\\.
• Unusual outbound connections from the SuperAGI server (e.g., to a C2 server) after a successful exploit.

File System IOCs:

• Unexpected files in /etc/, /app/, or other system directories that were not part of the original installation.
• Modified application files (e.g., config.py, main.py) with suspicious content.
• New cron jobs or systemd services pointing to attacker-controlled scripts.

Log IOCs:

• Application logs showing file save operations to paths outside the intended upload directory.
• System logs (e.g., auditd) showing file writes to sensitive locations.

Detection Engineering

YARA Rule

rule CVE_2025_51475_SuperAGI_AFO {
    meta:
        description = "Detects attempts to exploit CVE-2025-51475 via directory traversal in file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-51475"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $upload_endpoint = "/upload"
    condition:
        any of ($traversal*) and $upload_endpoint
}

Sigma Rule

title: SuperAGI Arbitrary File Overwrite via Directory Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to SuperAGI upload endpoint with directory traversal patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-51475 SuperAGI Arbitrary File Overwrite Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/upload"; http.client_body; content:"../"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the file upload endpoint if not required, or restrict access to it via firewall or authentication.
2. Apply input validation on the server side: sanitize filenames to remove any path traversal characters (e.g., ../, ..\\).
3. Use a secure file upload library that automatically prevents directory traversal (e.g., secure_filename from Werkzeug).
4. Implement strict filesystem permissions so that the application can only write to a specific, sandboxed directory.

Long-term Fix:

• The vendor (TransformerOptimus) should release a patched version that includes proper path validation as shown in the patched code example.
• Until a patch is available, consider forking the repository and applying the fix yourself.

Detection:

• Deploy the YARA, Sigma, and Suricata rules provided above.
• Monitor for anomalous file writes and network connections.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert