CVE-2024-40422: Stitionai Devika Path Traversal Flaw

CVE-2024-40422 Overview

CVE-2024-40422 is a critical path traversal vulnerability affecting the /api/get-browser-snapshot endpoint in Stitionai Devika v1, an AI-powered software development assistant. The snapshot_path parameter in this endpoint fails to properly validate and sanitize user input, allowing attackers to traverse directories and access arbitrary files on the server. This vulnerability poses a significant threat to organizations running Devika instances, as it can lead to unauthorized access to critical system files, configuration data, and sensitive information stored on the server.

Critical Impact
Unauthenticated attackers can exploit this path traversal vulnerability to read sensitive files from the server, potentially exposing credentials, configuration files, source code, and other confidential data, compromising the confidentiality and integrity of the entire system.

Affected Products

Stitionai Devika v1.0

Discovery Timeline

2024-07-24 - CVE-2024-40422 published to NVD
2025-01-29 - Last updated in NVD database

Technical Details for CVE-2024-40422

Vulnerability Analysis

This path traversal vulnerability exists in the /api/get-browser-snapshot endpoint of Stitionai Devika v1. The endpoint accepts a snapshot_path parameter that is intended to retrieve browser snapshot files for the AI assistant's web browsing functionality. However, the application fails to properly validate or sanitize this input, allowing attackers to include directory traversal sequences such as ../ to escape the intended directory structure and access files anywhere on the filesystem that the application has read permissions for.

The vulnerability requires no authentication and can be exploited remotely over the network with minimal complexity. Successful exploitation allows attackers to read arbitrary files from the server, including system configuration files like /etc/passwd, application configuration files that may contain database credentials or API keys, and potentially source code or other sensitive business data.

Root Cause

The root cause of CVE-2024-40422 is improper input validation in the snapshot_path parameter handling. The application does not implement proper path canonicalization or restrict file access to a designated safe directory. Without sanitization of traversal sequences (../, ..\\, or URL-encoded variants), user-controlled input can manipulate the file path to reference files outside the intended snapshot directory.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can craft a malicious HTTP request to the /api/get-browser-snapshot endpoint with a snapshot_path parameter containing directory traversal sequences. By carefully constructing the path, the attacker can navigate from the intended snapshot directory to any location on the filesystem.

For example, an attacker could send a request with a snapshot_path value like ../../../../etc/passwd to traverse out of the snapshot directory and access the system password file. The depth of traversal sequences can be adjusted based on the application's directory structure to reach the root filesystem.

Technical analysis and proof-of-concept details are available in the Medium Analysis on CVE-2024-40422 and the GitHub PoC Repository.

Detection Methods for CVE-2024-40422

Indicators of Compromise

HTTP requests to /api/get-browser-snapshot containing path traversal sequences such as ../, ..\\, %2e%2e%2f, or %2e%2e/
Web server logs showing requests for sensitive system files like /etc/passwd, /etc/shadow, or application configuration files
Unusual file access patterns originating from the Devika application process
Failed or successful attempts to access files outside the designated snapshot directory

Detection Strategies

Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns in the snapshot_path parameter
Configure intrusion detection systems (IDS/IPS) to alert on HTTP requests containing directory traversal sequences targeting the /api/get-browser-snapshot endpoint
Enable verbose logging on the Devika application and monitor for file access attempts outside expected directories
Use SentinelOne's Singularity platform to detect anomalous file read operations and suspicious process behavior

Monitoring Recommendations

Monitor web server access logs for requests to /api/get-browser-snapshot with suspicious snapshot_path values
Set up alerts for any file read operations by the Devika process that access files outside the application's working directory
Implement network traffic analysis to detect exploitation attempts against exposed Devika instances
Regularly audit file access permissions and monitor for unauthorized access to sensitive system files

How to Mitigate CVE-2024-40422

Immediate Actions Required

Restrict network access to Devika instances to trusted internal networks only, removing public exposure where possible
Deploy a web application firewall (WAF) with rules to block path traversal attempts targeting the /api/get-browser-snapshot endpoint
Review access logs for any indication of prior exploitation attempts
Consider disabling the /api/get-browser-snapshot endpoint if browser snapshot functionality is not required

Patch Information

A fix for this vulnerability has been submitted via GitHub Pull Request #619. Organizations running Stitionai Devika should review this pull request and apply the fix or update to a patched version when officially released. Monitor the GitHub Project Repository for official security releases.

Workarounds

Implement a reverse proxy or API gateway in front of Devika that validates and sanitizes the snapshot_path parameter before forwarding requests
Modify the application configuration to run Devika with minimal filesystem permissions, restricting read access to only necessary directories
Use containerization or sandboxing to isolate the Devika application and limit the impact of file access even if exploited
Implement network segmentation to ensure Devika instances cannot access sensitive internal systems

bash

# Example nginx configuration to block path traversal attempts
location /api/get-browser-snapshot {
    # Block requests with path traversal sequences
    if ($arg_snapshot_path ~* "(\.\.|%2e%2e)") {
        return 403;
    }
    proxy_pass http://devika_backend;
}