CVE-2024-8501: Arbitrary File Download in modelscope/agentscope
An arbitrary file download vulnerability exists in the rpcagentclient component of modelscope/agentscope version v0.0.4. This vulnerability allows any user to download any file from the rpcagent's host by exploiting the downloadfile method. This can lead to unauthorized access to sensitive information, including configuration files, credentials, and potentially system files, which may facilitate further exploitation such as privilege escalation or lateral movement within the network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8501?
CVE-2024-8501 has been rated as a high severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2024-8501?
To fix CVE-2024-8501, update to a version of the agentscope package that is higher than v0.0.4.
Who is affected by CVE-2024-8501?
CVE-2024-8501 affects users of modelscope/agentscope version v0.0.4 and earlier.
What exploitation method is used in CVE-2024-8501?
CVE-2024-8501 can be exploited through the download_file method in the rpc_agent_client component.
What are the consequences of exploiting CVE-2024-8501?
Exploiting CVE-2024-8501 can lead to unauthorized access and downloading of sensitive files from the host system.