CVE-2024-8537: Modelscope Agentscope Path Traversal Flaw

CVE-2024-8537 Overview

A critical path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow endpoint, allowing an attacker to delete arbitrary files from the filesystem. This issue arises due to improper input validation, enabling the attacker to manipulate file paths and delete sensitive files outside of the intended directory.

Critical Impact

Unauthenticated attackers can exploit this path traversal vulnerability to delete arbitrary files on the system, potentially leading to denial of service, data loss, or system compromise through the removal of critical configuration and security files.

Affected Products

• modelscope agentscope (all versions)

Discovery Timeline

• 2025-03-20 - CVE-2024-8537 published to NVD
• 2025-08-01 - Last updated in NVD database

Technical Details for CVE-2024-8537

Vulnerability Analysis

This path traversal vulnerability (CWE-29) in Modelscope AgentScope allows remote attackers to delete arbitrary files from the filesystem without authentication. The /delete-workflow endpoint fails to properly validate and sanitize user-supplied file path inputs before performing file deletion operations.

The vulnerability enables attackers to escape the intended workflow directory by using path traversal sequences (such as ../) to navigate to parent directories and target sensitive system files. Since the attack requires no authentication and can be executed remotely over the network with low complexity, it poses a significant risk to system integrity and availability.

Root Cause

The root cause of this vulnerability is improper input validation in the /delete-workflow endpoint. The application does not adequately sanitize or validate file path parameters before using them in file system operations. Specifically, the endpoint fails to:

1. Canonicalize the provided file path to resolve symbolic links and traversal sequences
2. Verify that the resolved path remains within the intended workflow directory
3. Block or filter path traversal characters and sequences

This allows attackers to craft malicious requests containing directory traversal sequences that escape the application's intended directory boundaries.

Attack Vector

The attack is executed remotely over the network against the /delete-workflow endpoint. An attacker crafts a malicious HTTP request containing path traversal sequences in the workflow file parameter. When processed by the vulnerable endpoint, the application follows the manipulated path to delete files outside the intended directory.

The attack requires no authentication or user interaction, and can be used to delete critical system files, application configuration files, or security-related files, potentially causing denial of service or facilitating further attacks.

For detailed technical information about this vulnerability, refer to the Huntr Bounty Report.

Detection Methods for CVE-2024-8537

Indicators of Compromise

• HTTP requests to /delete-workflow containing path traversal sequences such as ../, ..%2F, or ..%5C
• Unexpected file deletions in system directories or outside the application's workflow directory
• Web server access logs showing suspicious requests with encoded traversal characters targeting the delete endpoint
• Missing critical system or configuration files with no legitimate explanation

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing path traversal patterns targeting the /delete-workflow endpoint
• Monitor application logs for requests with abnormal path parameters, particularly those containing multiple parent directory references
• Deploy file integrity monitoring (FIM) on critical system directories to detect unauthorized file deletions
• Create intrusion detection system (IDS) signatures to alert on HTTP requests matching known path traversal attack patterns

Monitoring Recommendations

• Enable verbose logging for all file system operations performed by the AgentScope application
• Set up real-time alerts for any file deletion operations outside the designated workflow directory
• Monitor for unusual spikes in requests to the /delete-workflow endpoint
• Implement endpoint detection and response (EDR) solutions to track file system activity associated with the AgentScope process

How to Mitigate CVE-2024-8537

Immediate Actions Required

• Restrict network access to the AgentScope application to trusted networks and users only
• Implement web application firewall rules to block requests containing path traversal sequences
• Consider disabling or restricting access to the /delete-workflow endpoint until a patch is available
• Deploy file integrity monitoring on critical system files and directories

Patch Information

No vendor patch information is currently available for this vulnerability. Organizations should monitor the Modelscope AgentScope project for security updates and apply patches as soon as they become available. For the latest information on this vulnerability, refer to the Huntr Bounty Report.

Workarounds

• Implement strict input validation at the network perimeter using a reverse proxy or WAF to filter path traversal attempts
• Run the AgentScope application with minimal filesystem permissions, restricting the service account's ability to delete files outside the workflow directory
• Use containerization or sandboxing to isolate the application and limit the impact of potential exploitation
• Implement network segmentation to limit attacker access to systems running vulnerable AgentScope instances

# Example: Restrict file system permissions for AgentScope service account
# Create dedicated service account with limited permissions
useradd -r -s /sbin/nologin agentscope-service

# Restrict workflow directory ownership
chown -R agentscope-service:agentscope-service /opt/agentscope/workflows

# Remove write permissions from parent directories
chmod 755 /opt/agentscope
chmod 700 /opt/agentscope/workflows