CVE-2024-9415
📋 TL;DR
A path traversal vulnerability in transformeroptimus/superagi version 0.0.14 allows attackers to upload arbitrary files to any location on the server. This can lead to remote code execution or file overwriting attacks. Organizations using this specific version of the superagi software are affected.
💻 Affected Systems
- transformeroptimus/superagi
📦 What is this software?
Superagi by Superagi
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through remote code execution, data destruction via file overwriting, or persistent backdoor installation.
Likely Case
Unauthorized file upload leading to web shell deployment, sensitive file access, or denial of service through critical file corruption.
If Mitigated
Limited impact with proper file upload validation, restricted permissions, and network segmentation preventing exploitation.
🎯 Exploit Status
Exploitation requires understanding of path traversal techniques and file upload mechanisms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.0.15 or later
Vendor Advisory: https://huntr.com/bounties/31bdf98c-5205-4c48-9bc7-9e780ba63398
Restart Required: No
Instructions:
1. Update superagi to version 0.0.15 or later using pip: pip install --upgrade superagi 2. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable file upload functionality
allTemporarily disable the vulnerable file upload feature until patching is possible.
Implement file upload validation
allAdd server-side validation to restrict file uploads to safe locations and extensions.
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted sources only.
- Deploy web application firewall (WAF) rules to detect and block path traversal attempts.
🔍 How to Verify
Check if Vulnerable:
Check the installed superagi version: pip show superagi | grep VersionCheck Version:
pip show superagi | grep VersionVerify Fix Applied:
Confirm version is 0.0.15 or later: pip show superagi | grep Version📡 Detection & Monitoring
Log Indicators:
- Unusual file upload attempts with directory traversal sequences (../)
- File writes to unexpected server locations
Network Indicators:
- HTTP POST requests to upload endpoints containing path traversal patterns
SIEM Query:
source="web_logs" AND (url="*upload*" AND (data="*../*" OR data="*..\\*"))