CVE-2024-40422
📋 TL;DR
This vulnerability allows attackers to perform path traversal attacks via the snapshot_path parameter in Devika v1's API endpoint. By manipulating this parameter, attackers can access sensitive files outside the intended directory. This affects all users running vulnerable versions of Devika v1.
💻 Affected Systems
- stitionai devika
📦 What is this software?
Devika by Stitionai
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like /etc/passwd, SSH keys, configuration files, or database credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized access to application configuration files, source code, or other sensitive data stored on the server, compromising confidentiality.
If Mitigated
Limited impact if proper input validation and access controls are implemented, restricting file access to intended directories only.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint with crafted parameters. Public proof-of-concept code is available in the GitHub repository.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version with PR #619 applied
Vendor Advisory: https://github.com/stitionai/devika/pull/619
Restart Required: Yes
Instructions:
1. Update to the latest Devika version that includes PR #619. 2. Apply the security patch that adds proper input validation to the snapshot_path parameter. 3. Restart the Devika service.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allBlock requests containing path traversal sequences in the snapshot_path parameter
Disable Vulnerable Endpoint
allTemporarily disable or restrict access to the /api/get-browser-snapshot endpoint
🧯 If You Can't Patch
- Implement strict input validation to reject any snapshot_path containing '../' or absolute paths
- Restrict file system permissions for the Devika process to limit accessible directories
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to /api/get-browser-snapshot with snapshot_path containing '../etc/passwd' or similar traversal sequencesCheck Version:
Check Devika version in package.json or application configurationVerify Fix Applied:
Attempt the same path traversal attack after patching; it should return an error or sanitized path📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /api/get-browser-snapshot with '../' sequences in parameters
- Unusual file access patterns from the Devika process
Network Indicators:
- HTTP requests with encoded path traversal sequences (%2e%2e%2f, ..%2f, etc.)
SIEM Query:
source="devika" AND (url_path="/api/get-browser-snapshot" AND (param="*../*" OR param="*..\\*"))🔗 References
- https://github.com/alpernae/CVE-2024-40422
- https://github.com/stitionai/devika
- https://github.com/stitionai/devika/pull/619
- https://medium.com/@alpernae/uncovering-path-traversal-in-devika-v1-a-deep-dive-into-cve-2024-40422-f8ce81398b99
- https://github.com/alpernae/CVE-2024-40422
- https://github.com/stitionai/devika
- https://github.com/stitionai/devika/pull/619
