CVE-2024-47170: Agnai File Disclosure Vulnerability Path Traversal Vulnerability

LOW
Advisory Identifier: GHSA-h355-hm5h-cm8h
Share
CVSS 4.3
CWE-35 CWE-22
Published
Advisory Summary

CVE-2024-47170 is a LOW (CVSS 4.3) path traversal vulnerability (CWE-35: Path Traversal: '.../...//') affecting Agnai File Disclosure Vulnerability libraries in the npm ecosystem. The issue involves json via path traversal. Remediation is available by upgrading affected packages to version 1.0.330.

CVE-2024-47170 at a Glance

CVE Identifier CVE-2024-47170
GHSA Identifier GHSA-h355-hm5h-cm8h
Severity LOW
CVSS v3.1 Base Score 4.3
CWE Classification CWE-35: Path Traversal: '.../...//'
Affected Product Agnai File Disclosure Vulnerability
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 4.3

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2024-47170

To remediate this vulnerability, upgrade all affected Agnai File Disclosure Vulnerability dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

agnai fixed: 1.0.330 
npm install agnai@1.0.330
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls agnai

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2024-47170, inspect your project dependencies using npm:

npm ls agnai

Analyze the terminal output to locate any version of Agnai File Disclosure Vulnerability in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.0.330), your application is affected.

Note: The npm ls agnai command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-35: Path Traversal: '.../...//', where the product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. In Agnai File Disclosure Vulnerability, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### CWE-35: Path Traversal https://cwe.mitre.org/data/definitions/35.html ### CVSSv3.1 4.3 - Medium CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N ### Summary A vulnerability has been discovered in **Agnai** that permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. **This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only.** ### Details & PoC This is a path traversal vulnerability. An attacker can exploit this vulnerability by sending a specially crafted request: ```tsx GET /api/json/messages/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%61%70%70%2fpackage HTTP/1.1 ``` In this example, the attacker retrieves the `package.json` file content from the server by manipulating the file path. The request is processed by the `loadMessages` handler in `agnai/srv/api/json/index.ts` and a file is read and returned to the client. The read filename is constructed using string interpolation, with no guard or check for path traversal: https://github.com/agnaistic/agnai/blob/2b878b7ca66471c5dd080197ad9ca2f7f0022655/srv/api/json/index.ts#L77 #### Constraints Environment constraints: JSON Storage enabled (non standard) ### Impact This vulnerability is classified as a path traversal vulnerability. Specifically, any JSON file on the server which the webserver process has read privileges for, can be disclosed to the attacker. ### Credit - @ropwareJB - @noe233

CVE-2024-47170 Affected Agnai File Disclosure Vulnerability Versions

1 component(s)
Fixed Versions:
1.0.330
Product / Package Ecosystem Affected Versions Fixed Version
agnai
npm/agnai
npm
< 1.0.330
1.0.330

References

GitHub Advisory / Wiki ADVISORY
https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h
NVD — CVE-2024-47170 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47170
Agnai File Disclosure Vulnerability Source Repository REPOSITORY
https://github.com/agnaistic/agnai

Frequently Asked Questions

What is CVE-2024-47170?
CVE-2024-47170 is a security vulnerability in Agnai File Disclosure Vulnerability involving JSON via Path Traversal under CWE-35: Path Traversal: '.../...//'.
Which Agnai File Disclosure Vulnerability versions are affected?
Affected versions include releases prior to 1.0.330 across affected packages: agnai.
What version fixes CVE-2024-47170?
Upgrading to 1.0.330 (or the latest patched release for your respective branch) resolves the vulnerability.
Is agnai affected?
Yes, agnai is affected in releases prior to 1.0.330. Upgrade your dependency to 1.0.330 or later.
What is the CVSS score of CVE-2024-47170?
CVE-2024-47170 has a CVSS v3.1 base score of 4.3 (LOW) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2024-47170?
CVE-2024-47170 is classified under CWE-35: Path Traversal: '.../...//' (The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.).
How can I check npm dependencies for CVE-2024-47170?
Run the dependency tree command: 'npm ls agnai'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-h355-hm5h-cm8h",
  "modified" : "2024-09-26T21:11:05Z",
  "published" : "2024-09-26T18:07:52Z",
  "aliases" : [ "CVE-2024-47170" ],
  "summary" : "Agnai File Disclosure Vulnerability: JSON via Path Traversal ",
  "details" : "### CWE-35: Path Traversal\n\nhttps://cwe.mitre.org/data/definitions/35.html\n\n### CVSSv3.1 4.3 - Medium\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\n\n### Summary\n\nA vulnerability has been discovered in **Agnai** that permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files.\n**This only affects installations with `JSON_STORAGE` enabled which is intended to local/self-hosting only.**\n\n### Details & PoC\n\nThis is a path traversal vulnerability. An attacker can exploit this vulnerability by sending a specially crafted request:\n\n```tsx\nGET /api/json/messages/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%61%70%70%2fpackage HTTP/1.1\n```\n\nIn this example, the attacker retrieves the `package.json` file content from the server by manipulating the file path.\n\nThe request is processed by the `loadMessages` handler in `agnai/srv/api/json/index.ts` and a file is read and returned to the client. The read filename is constructed using string interpolation, with no guard or check for path traversal: https://github.com/agnaistic/agnai/blob/2b878b7ca66471c5dd080197ad9ca2f7f0022655/srv/api/json/index.ts#L77\n\n#### Constraints\n\nEnvironment constraints: JSON Storage enabled (non standard)\n\n### Impact\n\nThis vulnerability is classified as a path traversal vulnerability. Specifically, any JSON file on the server which the webserver process has read privileges for, can be disclosed to the attacker.\n\n### Credit\n- @ropwareJB\n- @noe233",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "agnai"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.330"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-47170"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/agnaistic/agnai"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22", "CWE-35" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-09-26T18:07:52Z",
    "nvd_published_at" : "2024-09-26T18:15:10Z"
  }
}