Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal

Vulnerability

Details

CVE-2024-47169 is a critical vulnerability in Agnai, an AI-agnostic multi-user roleplaying chat system, affecting versions prior to 1.0.330. The flaw combines a path traversal weakness (CWE-35) with unrestricted file upload of dangerous file types (CWE-434) [1][2]. Specifically, the _id parameter in the POST /api/chat/{id}/temp-character endpoint is not properly sanitized, allowing an attacker to traverse directories and write files to arbitrary locations on the server [2]. Additionally, the entityUploadBase64 function in srv/api/upload.ts does not validate the filename or content, enabling the upload of arbitrary files including JavaScript [2].

Exploitation and

Impact

An authenticated attacker can exploit this by crafting a request with a path traversal payload in the _id field, uploading a malicious JavaScript file to a location such as the server's application directory [2]. This allows the attacker to execute arbitrary commands on the server when the uploaded file is accessed or triggered. The attack requires network access and low-privilege authentication, and the CVSS 4.0 base score is 9.0 (Critical) [2]. Successful exploitation could lead to unauthorized access, full server compromise, data leakage, and other critical security threats [1][2].

Mitigation and

Scope

This vulnerability does not affect the official agnai.chat instance, installations using S3-compatible storage, or self-hosted instances that are not publicly exposed [1][2]. It specifically impacts publicly hosted installations that do not use S3-compatible storage [1][2]. The issue has been fixed in version 1.0.330, and users are strongly advised to upgrade immediately [1][2]. No workarounds are documented.