cvelistv5 - CVE-2024-10833

CVE-2024-10833 (GCVE-0-2024-10833)

Vulnerability from cvelistv5 – Published: 2025-03-20 10:10 – Updated: 2025-10-15 12:50

Summary

eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the 'doc_file.filename' parameter is user-controllable, enabling the construction of absolute paths.

Severity ?

9.1 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-36 - Absolute Path Traversal

Assigner

@huntr_ai

References

URL

Tags

https://huntr.com/bounties/dc58e981-e325-4c11-b4e…

Impacted products

	Vendor	Product	Version
	eosphoros-ai	eosphoros-ai/db-gpt	Affected: unspecified , ≤ latest (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10833",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T17:51:56.921812Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T18:23:45.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "eosphoros-ai/db-gpt",
          "vendor": "eosphoros-ai",
          "versions": [
            {
              "lessThanOrEqual": "latest",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as \u0027knowledge\u0027 is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the \u0027doc_file.filename\u0027 parameter is user-controllable, enabling the construction of absolute paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-36",
              "description": "CWE-36 Absolute Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-15T12:50:11.814Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntr_ai"
      },
      "references": [
        {
          "url": "https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a"
        }
      ],
      "source": {
        "advisory": "dc58e981-e325-4c11-b4e1-1095890fd15a",
        "discovery": "EXTERNAL"
      },
      "title": "Arbitrary File Write in eosphoros-ai/db-gpt"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntr_ai",
    "cveId": "CVE-2024-10833",
    "datePublished": "2025-03-20T10:10:15.995Z",
    "dateReserved": "2024-11-04T23:10:40.205Z",
    "dateUpdated": "2025-10-15T12:50:11.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-10833\",\"sourceIdentifier\":\"security@huntr.dev\",\"published\":\"2025-03-20T10:15:20.630\",\"lastModified\":\"2025-10-15T13:15:37.387\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as \u0027knowledge\u0027 is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the \u0027doc_file.filename\u0027 parameter is user-controllable, enabling the construction of absolute paths.\"},{\"lang\":\"es\",\"value\":\"La versi\u00f3n 0.6.0 de eosphoros-ai/db-gpt es vulnerable a la escritura arbitraria de archivos a trav\u00e9s de la API de conocimiento. El endpoint para subir archivos como \\\"conocimiento\\\" es susceptible a path traversal absoluto, lo que permite a los atacantes escribir archivos en ubicaciones arbitrarias en el servidor objetivo. Esta vulnerabilidad surge porque el par\u00e1metro \\\"doc_file.filename\\\" es controlable por el usuario, lo que permite la construcci\u00f3n de rutas absolutas.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"security@huntr.dev\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\",\"baseScore\":9.1,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"security@huntr.dev\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-36\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBDB9D41-53F0-4893-AD12-C627705D4615\"}]}]}],\"references\":[{\"url\":\"https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a\",\"source\":\"security@huntr.dev\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-10833\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-20T17:51:56.921812Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-20T17:51:58.654Z\"}}], \"cna\": {\"title\": \"Arbitrary File Write in eosphoros-ai/db-gpt\", \"source\": {\"advisory\": \"dc58e981-e325-4c11-b4e1-1095890fd15a\", \"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"cvssV3_0\": {\"scope\": \"UNCHANGED\", \"version\": \"3.0\", \"baseScore\": 9.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"eosphoros-ai\", \"product\": \"eosphoros-ai/db-gpt\", \"versions\": [{\"status\": \"affected\", \"version\": \"unspecified\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"latest\"}]}], \"references\": [{\"url\": \"https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as \u0027knowledge\u0027 is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the \u0027doc_file.filename\u0027 parameter is user-controllable, enabling the construction of absolute paths.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-36\", \"description\": \"CWE-36 Absolute Path Traversal\"}]}], \"providerMetadata\": {\"orgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"shortName\": \"@huntr_ai\", \"dateUpdated\": \"2025-10-15T12:50:11.814Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-10833\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-15T12:50:11.814Z\", \"dateReserved\": \"2024-11-04T23:10:40.205Z\", \"assignerOrgId\": \"c09c270a-b464-47c1-9133-acb35b22c19a\", \"datePublished\": \"2025-03-20T10:10:15.995Z\", \"assignerShortName\": \"@huntr_ai\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-10833

Vulnerability from fkie_nvd - Published: 2025-03-20 10:15 - Updated: 2025-10-15 13:15

Severity ?

9.1 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Summary

References

	URL	Tags
	security@huntr.dev	https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a	Exploit, Third Party Advisory

Impacted products

	Vendor	Product	Version
	dbgpt	db-gpt	0.6.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dbgpt:db-gpt:0.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBDB9D41-53F0-4893-AD12-C627705D4615",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as \u0027knowledge\u0027 is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the \u0027doc_file.filename\u0027 parameter is user-controllable, enabling the construction of absolute paths."
    },
    {
      "lang": "es",
      "value": "La versi\u00f3n 0.6.0 de eosphoros-ai/db-gpt es vulnerable a la escritura arbitraria de archivos a trav\u00e9s de la API de conocimiento. El endpoint para subir archivos como \"conocimiento\" es susceptible a path traversal absoluto, lo que permite a los atacantes escribir archivos en ubicaciones arbitrarias en el servidor objetivo. Esta vulnerabilidad surge porque el par\u00e1metro \"doc_file.filename\" es controlable por el usuario, lo que permite la construcci\u00f3n de rutas absolutas."
    }
  ],
  "id": "CVE-2024-10833",
  "lastModified": "2025-10-15T13:15:37.387",
  "metrics": {
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2,
        "source": "security@huntr.dev",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-03-20T10:15:20.630",
  "references": [
    {
      "source": "security@huntr.dev",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a"
    }
  ],
  "sourceIdentifier": "security@huntr.dev",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-36"
        }
      ],
      "source": "security@huntr.dev",
      "type": "Primary"
    }
  ]
}

GHSA-J9G7-MQHH-9HXF

Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-21 17:24

Summary

DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload

Details

Severity ?

9.1 (Critical)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "dbgpt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-10833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-36"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-21T17:24:47Z",
    "nvd_published_at": "2025-03-20T10:15:20Z",
    "severity": "CRITICAL"
  },
  "details": "eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as \u0027knowledge\u0027 is susceptible to absolute path traversal, allowing attackers to write files to arbitrary locations on the target server. This vulnerability arises because the \u0027doc_file.filename\u0027 parameter is user-controllable, enabling the construction of absolute paths.",
  "id": "GHSA-j9g7-mqhh-9hxf",
  "modified": "2025-03-21T17:24:48Z",
  "published": "2025-03-20T12:32:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10833"
    },
    {
      "type": "WEB",
      "url": "https://github.com/eosphoros-ai/DB-GPT/commit/780ce803e325b87f4ddfbe5824451e379aeee56c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/eosphoros-ai/DB-GPT"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/dc58e981-e325-4c11-b4e1-1095890fd15a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-10833 (GCVE-0-2024-10833)

FKIE_CVE-2024-10833

GHSA-J9G7-MQHH-9HXF

Tags

Sightings

Nomenclature