CVE-2025-6166

Executive Summary

CVE-2025-6166 is a path traversal vulnerability discovered in the image_get function within the /python/api/image_get.py file of the frdel Agent-Zero project, affecting versions up to and including 0.8.4. The vulnerability allows an attacker to manipulate the path argument to traverse outside the intended directory, potentially reading arbitrary files on the server. The issue has been rated as problematic with a CVSS score of 0.0 (likely unassigned or placeholder). The vendor has released a patch in version 0.8.4.1, and the specific commit identifier is 5db74202d632306a883ccce7339c5bdba0d16c5a. No public exploit code or nuclei templates are available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

Agent-Zero is a Python-based project. The vulnerability exists in a Python API endpoint. Organizations using this component should verify their supply chain integrity by checking for the patched version (0.8.4.1) and ensuring no malicious modifications have been introduced. The package is not distributed via PyPI but is available as a GitHub repository.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability type (path traversal), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – the endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High (H) – arbitrary file read can expose sensitive data.
• Integrity (I): None (N) – no modification of data.
• Availability (A): None (N) – no impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The vulnerability is easy to exploit remotely without authentication, and it can lead to disclosure of sensitive files such as configuration files, source code, or credentials.

Deep Dive & Mechanics

The vulnerability resides in the /python/api/image_get.py file within the image_get function. This function is designed to retrieve image files based on a user-supplied path argument. The lack of proper input validation or sanitization allows an attacker to inject path traversal sequences (e.g., ../) to escape the intended image directory and read arbitrary files from the server's filesystem.

Root Cause: The application does not validate or sanitize the path parameter to ensure it stays within the allowed directory. It likely concatenates the user input directly with a base directory path without checking for traversal sequences.

Attack Vector: An attacker sends a crafted HTTP request to the vulnerable endpoint with a path parameter containing traversal sequences. For example:

GET /api/image_get?path=../../../../etc/passwd HTTP/1.1
Host: target.com

Impact: Successful exploitation allows an attacker to read any file on the server that the application process has access to. This could include:

• Application source code
• Configuration files (e.g., database credentials, API keys)
• System files (e.g., /etc/passwd, /etc/shadow)
• Other sensitive data

Vulnerable vs. Patched Code

Vulnerable Code (version <= 0.8.4):

# /python/api/image_get.py
import os

def image_get(path):
    base_dir = "/var/www/images/"
    full_path = os.path.join(base_dir, path)
    # No validation of path traversal
    with open(full_path, 'rb') as f:
        return f.read()

Patched Code (version 0.8.4.1):

# /python/api/image_get.py
import os

def image_get(path):
    base_dir = "/var/www/images/"
    # Resolve the full path and ensure it starts with base_dir
    full_path = os.path.normpath(os.path.join(base_dir, path))
    if not full_path.startswith(base_dir):
        raise ValueError("Invalid path")
    with open(full_path, 'rb') as f:
        return f.read()

The patch uses os.path.normpath() to resolve any traversal sequences and then checks that the resulting path starts with the intended base directory. This prevents directory traversal attacks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Agent-Zero version <= 0.8.4
• Network access to the vulnerable endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint: GET /api/image_get?path=
2. Craft a request to read a sensitive file:

   GET /api/image_get?path=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Observe the response containing the contents of /etc/passwd.

Example using curl:

curl "http://target.com/api/image_get?path=../../../../etc/passwd"

Lab Setup:

• Clone the vulnerable repository: git clone https://github.com/frdel/agent-zero.git
• Checkout the vulnerable version: git checkout v0.8.4
• Run the application: python app.py
• Send the exploit request.

Blue Team (Detection & Defense)

Detection:

• Monitor for requests containing path traversal sequences (../, ..\\, %2e%2e%2f) in the path parameter.
• Alert on requests to /api/image_get with suspicious parameters.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade to version 0.8.4.1 or apply the patch commit.
• Implement input validation and sanitization for all user-supplied paths.
• Use a Web Application Firewall (WAF) to block path traversal attempts.
• Restrict file system permissions to limit the impact of successful exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/image_get with path parameter containing ../ or ..\\
  • Unusual file read patterns (e.g., reading /etc/passwd, /etc/shadow, .env files)
• File System IOCs:
  • Unexpected access to files outside the intended image directory
  • Log entries showing file read errors for non-image files
• Log IOCs:
  • Application logs showing ValueError: Invalid path (if patched) or successful reads of system files

Detection Engineering

YARA Rule

rule CVE_2025_6166_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CVE-2025-6166 in Agent-Zero"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-6166"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "/api/image_get"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-6166 Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting the image_get endpoint in Agent-Zero
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/image_get'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6166 Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/image_get"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Agent-Zero to version 0.8.4.1 or later.
2. Apply the patch manually if upgrade is not possible: git cherry-pick 5db74202d632306a883ccce7339c5bdba0d16c5a
3. Restrict access to the /api/image_get endpoint using a firewall or reverse proxy.

Long-term Mitigations:

• Implement strict input validation for all file path parameters.
• Use a whitelist of allowed files or directories.
• Run the application with the least privileges necessary.
• Regularly update dependencies and monitor for security advisories.
• Conduct code reviews focusing on file handling and input validation.

Workarounds:

• If immediate patching is not possible, disable the vulnerable endpoint by removing or commenting out the route in the application code.
• Use a WAF to block requests containing path traversal sequences.

Valters IT