cbcvebase.
CVE-2024-5334
published 2024-06-27

CVE-2024-5334: A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the…

PriorityP277high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.07%
79.1th percentile
A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.

Affected

2 ranges
VendorProductVersion rangeFixed in
stitionaidevika——
stitionaistitionai_devika>= unspecified < --

Detection & IOCsextracted from sources · hover to see the quote

url/api/get-browser-snapshot?snapshot_path=/etc/passwd↗
path/api/get-browser-snapshot↗
regexroot:.*:0:0:↗
otherattachment; filename=passwd↗
  • →Monitor HTTP GET requests to '/api/get-browser-snapshot' with a 'snapshot_path' parameter containing path traversal sequences or absolute paths (e.g., /etc/passwd). Responses with Content-Disposition header 'attachment; filename=passwd' and Content-Type 'application/octet-stream' indicate successful exploitation. ↗
  • →Use Shodan/FOFA queries to identify exposed Devika AI instances: shodan-query 'title:"Devika AI"' and fofa-query 'title="Devika AI"'. ↗
  • →Successful exploitation returns HTTP 200 with a response body matching 'root:.*:0:0:' (Unix /etc/passwd content) and response headers containing 'attachment; filename=passwd' and 'application/octet-stream'. ↗
  • ·The vulnerability affects the latest version of the stitionai/devika repository at the time of disclosure. A patch was committed; verify whether the target instance has applied commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2. ↗
  • ·The endpoint is unauthenticated and network-accessible (CVSS AV:N/AC:L/PR:N/UI:N), meaning no credentials are required to exploit it remotely. ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.