CVE-2024-10834
📋 TL;DR
This vulnerability in eosphoros-ai/db-gpt version 0.6.0 allows attackers to write arbitrary files to any location on the server by exploiting the RAG-knowledge endpoint. Attackers can overwrite critical system files or create SSH keys, potentially leading to complete system compromise. All users running the vulnerable version are affected.
💻 Affected Systems
- eosphoros-ai/db-gpt
📦 What is this software?
Db Gpt by Dbgpt
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover via SSH key injection or critical system file overwrite, leading to persistent backdoor access, data theft, or service disruption.
Likely Case
Unauthorized file creation/modification in web directories leading to web shell deployment, privilege escalation, or data manipulation.
If Mitigated
Limited impact if proper file system permissions restrict web user write access to sensitive directories.
🎯 Exploit Status
Exploit requires access to the vulnerable endpoint but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.6.1 or later
Vendor Advisory: https://huntr.com/bounties/0d598508-151a-4050-9ccd-31bb82955e7a
Restart Required: Yes
Instructions:
1. Update to version 0.6.1 or later using pip: pip install --upgrade db-gpt
2. Restart the db-gpt service
3. Verify the fix by checking the version
🔧 Temporary Workarounds
Disable RAG-knowledge endpoint
allTemporarily disable the vulnerable endpoint until patching is possible
Modify configuration to disable RAG-knowledge API endpoint
Implement file path validation
allAdd input validation to reject absolute paths in filename parameters
Implement server-side validation to check for absolute paths in doc_file.filename
🧯 If You Can't Patch
- Implement strict file system permissions to restrict web user write access to sensitive directories
- Deploy web application firewall (WAF) rules to block requests containing absolute paths in filename parameters
🔍 How to Verify
Check if Vulnerable:
Check if running version 0.6.0 and if RAG-knowledge endpoint is accessibleCheck Version:
pip show db-gpt | grep VersionVerify Fix Applied:
Verify version is 0.6.1 or later and test that absolute paths in filename parameters are rejected📡 Detection & Monitoring
Log Indicators:
- Requests to RAG-knowledge endpoint with absolute paths in filename parameters
- File write operations to unexpected system locations
Network Indicators:
- HTTP POST requests to /api/v1/rag/knowledge with suspicious filename parameters
SIEM Query:
source="web_logs" AND uri="/api/v1/rag/knowledge" AND (filename CONTAINS "/" OR filename CONTAINS "..")