CVE-2024-5334 PoC — Devika 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5334.yaml

Associated Vulnerability

Title:Devika 安全漏洞 (CVE-2024-5334)
Description:Devika是一名高级人工智能软件工程师，能够理解高级人类指令，将其分解为步骤，研究相关信息，并编写代码以实现既定目标。 Devika 存在安全漏洞，该漏洞源于允许对文件名或路径进行外部控制。

Description

A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.

File Snapshot


 id: CVE-2024-5334

info:
  name: Devika - Local File Inclusion
  author: nechyo,nukunga,harksu,olflo

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!