CVE-2024-40422
Quick assessment
Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Devika是stition开源的一个高级 AI 软件工程师。可以理解高级人类指令，将它们分解为步骤，研究相关信息，并编写代码以实现给定的目标。 Devika v1版本存在安全漏洞，该漏洞源于容易受到路径穿越攻击，导致攻击者可以操纵snapshot_path参数来遍历目录和访问服务器上的敏感文件。
Possible ATT&CK Techniques 3 AI
T1552.001 · Credentials In Files T1005 · Data from Local System T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-40422
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Devika 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Devika是stition开源的一个高级 AI 软件工程师。可以理解高级人类指令，将它们分解为步骤，研究相关信息，并编写代码以实现给定的目标。 Devika v1版本存在安全漏洞，该漏洞源于容易受到路径穿越攻击，导致攻击者可以操纵snapshot_path参数来遍历目录和访问服务器上的敏感文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2024-40422
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/alpernae/CVE-2024-40422 | POC Details |
| 2 | Found this on exploit-db, decided to make my own for practice. This exploit will search out the passwd file and print the contents on a vulnerable system. | https://github.com/j3r1ch0123/CVE-2024-40422 | POC Details |
| 3 | The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-40422.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-40422
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-40422 (1)
Other References for CVE-2024-40422 (2)
Same Patch Batch · n/a · 2024-07-24 · 28 CVEs total
| CVE-2024-31977 | Adtran 834-5 安全漏洞 | |
| CVE-2024-36537 | cert-manager 安全漏洞 | |
| CVE-2024-36535 | Meshery 安全漏洞 | |
| CVE-2024-36536 | FabEdge 安全漏洞 | |
| CVE-2024-36533 | Volcano 安全漏洞 | |
| CVE-2024-36539 | Contour 安全漏洞 | |
| CVE-2024-36540 | External Secrets 安全漏洞 | |
| CVE-2024-36541 | Logging operator 安全漏洞 | |
| CVE-2024-36534 | HwameiStor 安全漏洞 | |
| CVE-2024-36538 | Chaos Mesh 安全漏洞 | |
| CVE-2024-40575 | Huawei openGauss 安全漏洞 | |
| CVE-2024-40137 | Dolibarr ERP/CRM 安全漏洞 | |
| CVE-2024-40495 | Linksys E2500 安全漏洞 | |
| CVE-2024-40767 | OpenStack 安全漏洞 | |
| CVE-2024-39345 | AdTran SRG 834-5 HDC17600021F1 安全漏洞 | |
| CVE-2024-31970 | AdTran SRG 834-5 HDC17600021F1 安全漏洞 | |
| CVE-2024-31971 | AdTran NetVanta 3120 安全漏洞 | |
| CVE-2024-41550 | CampCodes Supplier Management System 安全漏洞 | |
| CVE-2024-41462 | Tenda FH1201 安全漏洞 | |
| CVE-2024-41464 | Tenda FH1201 安全漏洞 |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2024-40422
No comments yet