CVE-2024-5548: Directory Traversal in stitionai/devika

Published Jun 27, 2024

Updated

A directory traversal vulnerability exists in the stitionai/devika repository, specifically within the /api/download-project endpoint. Attackers can exploit this vulnerability by manipulating the 'projectname' parameter in a GET request to download arbitrary files from the system. This issue affects the latest version of the repository. The vulnerability arises due to insufficient input validation in the 'downloadproject' function, allowing attackers to traverse the directory structure and access files outside the intended directory. This could lead to unauthorized access to sensitive files on the server.

Affected Software

2 affected components

stitionai devika

stitionai devika=1.0

Event History

Jun 27, 2024

CVE Published

via MITRE·05:33 PM

Data Sourced

via MITRE·05:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-5548?

CVE-2024-5548 has a medium severity due to the potential for unauthorized file access.

How do I fix CVE-2024-5548?

To fix CVE-2024-5548, sanitize and validate the 'project_name' parameter to prevent directory traversal.

What systems are affected by CVE-2024-5548?

CVE-2024-5548 affects the stitionai/devika repository, specifically the /api/download-project endpoint.

Can CVE-2024-5548 lead to data breaches?

Yes, CVE-2024-5548 can allow attackers to download sensitive files, possibly leading to data breaches.

Is CVE-2024-5548 a remote vulnerability?

Yes, CVE-2024-5548 is a remote vulnerability that can be exploited via HTTP GET requests.