CVE-2024-47169: Agnai Arbitrary File Upload RCE Flaw

CVE-2024-47169 Overview

CVE-2024-47169 is an arbitrary file upload vulnerability in Agnai, an AI-agnostic multi-user, multi-bot roleplaying chat system. Versions prior to 1.0.330 allow authenticated attackers to upload arbitrary files to attacker-chosen locations on the server. Uploaded JavaScript files can be executed, leading to command execution in the host context. The flaw stems from improper path handling during file uploads [CWE-35: Path Traversal].

The issue affects publicly hosted installations that do not use S3-compatible storage. The hosted agnai.chat service, deployments backed by S3-compatible storage, and non-public self-hosted instances are not affected. Version 1.0.330 remediates the flaw.

Critical Impact
Attackers with low-privilege access can achieve remote code execution, full server compromise, and data leakage on vulnerable Agnai deployments.

Affected Products

Agnai versions prior to 1.0.330
Publicly exposed self-hosted Agnai deployments without S3-compatible storage
Agnai instances relying on local filesystem storage for uploads

Discovery Timeline

2024-09-26 - CVE-2024-47169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47169

Vulnerability Analysis

Agnai exposes file upload endpoints that write user-supplied content to the server filesystem. In versions before 1.0.330, the application fails to properly canonicalize and validate destination paths supplied during upload operations. An authenticated attacker can craft upload requests that traverse the intended upload directory and place files at arbitrary locations served by the application.

Because the application serves static content and can execute JavaScript files within its Node.js runtime context, attacker-controlled files placed in executable locations enable command execution. The vulnerability chains an arbitrary write primitive with code execution, resulting in full server compromise.

The attack requires network access and low-privilege authentication. No user interaction is needed, and successful exploitation impacts confidentiality, integrity, and availability of the host.

Root Cause

The root cause is improper handling of file path components during upload processing, classified as [CWE-35: Path Traversal: '.../...//']. The upload handler accepts destination paths without enforcing that the resolved path remains within a designated upload directory. This allows ../ sequences and absolute paths to redirect writes outside the intended storage boundary.

Deployments using S3-compatible object storage are unaffected because uploads bypass the local filesystem and follow object-key semantics that do not translate traversal sequences into directory navigation.

Attack Vector

An attacker authenticates to a publicly reachable Agnai instance and issues an upload request specifying a target path outside the upload directory. The server writes the attacker-supplied content to that location. If the destination is a directory served by the web application or interpreted by the Node.js process, the attacker triggers execution by requesting the uploaded resource. See the GitHub Security Advisory GHSA-mpch-89gm-hm83 for advisory details.

Detection Methods for CVE-2024-47169

Indicators of Compromise

Unexpected .js, .html, or executable files appearing outside the designated Agnai uploads directory
HTTP upload requests containing path traversal sequences such as ../ or absolute paths in filename or destination parameters
Outbound network connections from the Agnai Node.js process to unfamiliar hosts following upload activity
New or modified files in application source directories with recent modification timestamps not tied to a deployment

Detection Strategies

Inspect web server and reverse proxy logs for upload endpoint requests that include traversal patterns or unusual destination parameters
Monitor the Agnai runtime for spawned child processes such as sh, bash, cmd.exe, or node invocations that are not part of normal application behavior
Track file integrity across the Agnai installation directory to identify writes outside the intended upload path

Monitoring Recommendations

Enable verbose access logging on the Agnai upload routes and forward logs to a centralized SIEM for correlation
Alert on process execution originating from the Agnai working directory outside expected binaries
Baseline outbound network traffic from the Agnai host and alert on deviations following upload requests

How to Mitigate CVE-2024-47169

Immediate Actions Required

Upgrade Agnai to version 1.0.330 or later on all publicly exposed deployments
Audit the filesystem for unauthorized files written outside the designated uploads directory since the deployment date
Rotate API keys, session secrets, and credentials stored on or accessible from the Agnai host if compromise is suspected
Restrict network exposure of Agnai instances that cannot be patched immediately

Patch Information

The maintainers released Agnai 1.0.330 to address the vulnerability. Deployment guidance and advisory context are available in the Agnai GitHub Security Advisory GHSA-mpch-89gm-hm83. Operators should redeploy from the fixed release rather than attempt manual patching.

Workarounds

Migrate storage to an S3-compatible object storage backend, which is not affected by the flaw
Remove public exposure by placing Agnai behind an authenticated reverse proxy or VPN until patching is complete
Restrict upload endpoints at the reverse proxy layer to trusted user populations
Enforce read-only filesystem permissions on application source directories to limit write primitives

bash

# Upgrade Agnai to the patched release
git fetch --tags
git checkout v1.0.330
npm install
npm run build

# Optional: enforce S3-compatible storage via environment variables
export USE_S3=true
export BUCKET_NAME=<your-bucket>
export BUCKET_ENDPOINT=<your-endpoint>