CVE-2024-8958: Composio Composio RCE Vulnerability

CVE-2024-8958 Overview

CVE-2024-8958 is an unrestricted file write and read vulnerability in composiohq/composio version 0.4.3. The flaw resides in the filetools actions component, which fails to properly validate file paths supplied by users. An attacker with network access can read arbitrary files and write files anywhere on the host running the Composio service. This file system access can enable privilege escalation or remote code execution depending on the deployment context. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated network attackers can read and write arbitrary files on systems running Composio 0.4.3, leading to potential remote code execution.

Affected Products

• Composio composiohq/composio version 0.4.3
• Deployments exposing Composio filetools actions to network access
• Applications integrating the vulnerable Composio package

Discovery Timeline

• 2025-03-20 - CVE-2024-8958 published to the National Vulnerability Database (NVD)
• 2025-04-01 - Last updated in NVD database

Technical Details for CVE-2024-8958

Vulnerability Analysis

The vulnerability exists in the filetools actions exposed by composiohq/composio0.4.3. Composio is an integration toolkit used to connect agents and applications to external tools and file operations. The filetools actions accept user-controlled file path parameters and operate on the local file system. Because the implementation does not validate or canonicalize these paths, attackers can supply arbitrary absolute paths or ../ sequences to escape any intended working directory.

Root Cause

The root cause is missing path validation and sanitization in the filetools actions. The code does not enforce a directory allowlist, does not resolve symbolic links, and does not reject path traversal sequences. As a result, file read and write operations execute with the privileges of the Composio process against any path on disk. This pattern aligns with CWE-434, where untrusted input controls file destination.

Attack Vector

An attacker reaches the vulnerable filetools actions over the network without authentication or user interaction. The attacker submits a crafted request containing a path such as /etc/passwd to read sensitive system files, or writes to locations like /etc/cron.d/ or a user's ~/.ssh/authorized_keys to achieve code execution or persistence. Writing to Python site-packages, application startup scripts, or systemd unit files can convert arbitrary write into remote code execution. The exploitation does not require knowledge of internal application state, only knowledge of the action endpoint.

No verified public proof-of-concept code is available. See the Huntr Bug Bounty Report for technical details from the original disclosure.

Detection Methods for CVE-2024-8958

Indicators of Compromise

• Filetools action requests containing path traversal sequences such as ../, ..\, or URL-encoded variants like %2e%2e%2f
• Filetools action requests targeting absolute paths outside the application working directory, for example /etc/, /root/, /var/log/, or C:\Windows\
• Unexpected modifications to files in system directories, cron paths, SSH key locations, or Python package directories owned by the Composio service account
• Outbound connections initiated by processes spawned from files recently written by the Composio process

Detection Strategies

• Inspect Composio application logs for filetools action invocations referencing paths outside expected project directories
• Apply file integrity monitoring on sensitive paths such as /etc, ~/.ssh, and cron directories on hosts running Composio
• Correlate Composio process file write events with subsequent process executions to identify write-then-execute exploitation chains
• Use network-based detections that flag HTTP requests to Composio endpoints containing path traversal patterns

Monitoring Recommendations

• Forward Composio request logs and host file system audit events to a centralized analytics platform for retention and correlation
• Alert on any file write performed by the Composio service user to paths outside its designated working directory
• Monitor for anomalous child processes spawned by the Composio runtime, particularly shells or interpreters

How to Mitigate CVE-2024-8958

Immediate Actions Required

• Upgrade composiohq/composio to a version later than 0.4.3 that addresses the filetools path validation flaw
• Restrict network exposure of Composio services to trusted clients only, using firewall rules or reverse proxy authentication
• Run the Composio process as a low-privilege, non-root user inside a container or chroot with read-only mounts for sensitive directories
• Audit hosts running Composio 0.4.3 for unauthorized file modifications in system, SSH, and cron directories

Patch Information

Review the Huntr Bug Bounty Report for vendor remediation guidance and the corresponding fixed release. Upgrade to the latest Composio release and verify that filetools actions now reject paths outside the configured working directory.

Workarounds

• Disable the filetools actions in Composio configurations where they are not required by the application
• Place the Composio process inside a container with the host file system mounted read-only and only specific working directories mounted read-write
• Apply mandatory access control profiles such as AppArmor or SELinux to constrain the Composio process to a limited set of paths

# Configuration example: run Composio in a restricted container
docker run --rm \
  --read-only \
  --user 10001:10001 \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -v /opt/composio/workdir:/workdir:rw \
  -p 127.0.0.1:8000:8000 \
  composiohq/composio:latest