Composio CLI Path Traversal Leads to Sensitive Credential Leakage (#3746)

Vulnerability Overview Title: Composio CLI Tool File Upload Path Bypasses Sensitive File Denylist, Leading to Credential Leakage in Agent Workflows Vulnerability ID: #3746 Status: Closed Reporter: George Chen (geo-chen) Report Date: June 1, 2024 Affected Version: v0.2.30 Vulnerability Type: Path Traversal, Sensitive Information Disclosure Description: The Composio CLI ( ) contains a file upload endpoint that reads local files and uploads them to S3 when executing tools with the parameter (e.g., with attachments). This endpoint invokes without validating the file path. Both the TypeScript Core SDK ( ) and the Python SDK ( ) include an explicit denylist that prevents the upload of files with names such as , , , , , , , , and . However, the CLI code omits this check entirely. In agent deployments, the LLM provides tool parameters—including calls to within the script—meaning a successful prompt injection attack could direct the parameter to sensitive credential files and identify methods to upload these files to an attacker-controlled S3 key or the Composio account storage. Impact Scope Affected Component: Composio CLI ( ) Affected Version: v0.2.30 Scope of Impact: Any scenario using the Composio CLI that allows an LLM to invoke , particularly via the or commands. Potential Risk: An attacker could use a prompt injection attack to compel the LLM to call and upload sensitive files (such as SSH private keys, AWS credentials, environment variables, cloud configurations, etc.) to an attacker-controlled S3 bucket or Composio account storage. Remediation Fix Status: Fixed Fix Date: June 6, 2024 Fixer: Alberto Schiabel (jkomyo) Fix Details: Added a call to in the CLI's file to ensure that the upload file path is not on the sensitive file denylist. The fix is located in at lines 149-153 and 165-170. POC Code Call Chain: 1. Line 211 in calls 2. calls 3. calls for each field value 4. calls 5. calls — no checks are applied 6. File bytes are uploaded to S3 and served via presigned URLs Direct CLI Invocation Example: Verification Results: The file is read and uploaded regardless of the path. The Core SDK and Python SDK both block this vector. Additional Information Related Resources: - GitHub Issue #3746 - GitHub Advisory GHSA-hp3h-89pf-5q58 Participants: - George Chen (geo-chen) - Rahul Tarak (CryogenicPlanet) - Alberto Schiabel (jkomyo) Labels: Bug, P3 Project: ComposioHQ/composio Milestone: None Relations: None Development: - Fix CLI file-upload path bypassing sensitive-file denylist (GHSA-hp3h-89pf-5q58) - fix(cli): enforce sensitive-file upload denylist (GHSA-hp3h-89pf-5q58) Version: @composio/cli@0.2.32-b0 App: Open in GitHub Copilot app --- Summary: The Composio CLI contains a path traversal vulnerability that allows attackers to upload sensitive files via prompt injection attacks. This vulnerability was fixed in version v0.2.32-b0 by adding a call to in the file upload path to ensure that the upload file path is not on the sensitive file denylist.

Goal Reached Thanks to every supporter — we hit 100%!

Composio CLI Path Traversal Leads to Sensitive Credential Leakage (#3746)

More from this source