CVE-2024-5334: Local File Read in stitionai/devika
A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshotpath' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshotpath' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5334?
The severity of CVE-2024-5334 is critical due to its potential to allow unauthorized access to sensitive local files.
How do I fix CVE-2024-5334?
To fix CVE-2024-5334, update to the patched version of the stitionai/devika repository which addresses the improper handling of the 'snapshot_path' parameter.
What is the impact of exploiting CVE-2024-5334?
Exploiting CVE-2024-5334 can allow an attacker to read arbitrary files on the server, leading to exposure of sensitive information.
Which versions of stitionai/devika are affected by CVE-2024-5334?
CVE-2024-5334 affects the stitionai/devika version 1.0.
What data can be accessed through CVE-2024-5334?
An attacker exploiting CVE-2024-5334 can access any file on the server that the application has permissions to read.