CVE-2024-8550: Local File Inclusion (LFI) in modelscope/agentscope

Published Feb 10, 2025

Updated

A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.

Affected Software

2 affected components

modelscope agentscope

modelscope agentscope=0.0.4

Event History

Feb 10, 2025

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-8550?

The severity of CVE-2024-8550 is considered high due to its potential to expose sensitive files on the server.

How do I fix CVE-2024-8550?

To fix CVE-2024-8550, update to the latest version of the ModelScope agentscope software where the vulnerability has been patched.

What type of vulnerability is CVE-2024-8550?

CVE-2024-8550 is a Local File Inclusion (LFI) vulnerability that allows unauthorized file access.

What can an attacker do with CVE-2024-8550?

An attacker exploiting CVE-2024-8550 can read arbitrary files from the server, potentially accessing sensitive information.

In which endpoint does CVE-2024-8550 exist?

CVE-2024-8550 exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4.