by Kastro
Paper/Archive/CVE-2024-10833

CVE-2024-10833

eosphoros-ai eosphoros-ai/db-gpt — Arbitrary File Write in eosphoros-ai/db-gpt

EPSS 0.8%public exploitCVSS 9.1
critical.is priorityof 100
49
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 57.8.578 × 2011.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.

Affected

ProductAffectedFixed inSource
eosphoros-ai/db-gptunspecified – latest–CNA

Scores by source

@huntr_ai (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refhuntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a