CVE-2024-53844

Vulnerability

CVE-2024-53844 is a path traversal vulnerability in the backup export functionality of EDDI, a middleware for LLM API bots. The flaw resides in RestExportService.java, where the botFilename parameter is not sanitized, allowing an attacker to input sequences like ..%2f..%2fetc%2fpasswd to access files outside the intended directory [1][2].

Exploitation

An attacker can exploit this by sending a crafted HTTP request to the /backup/export endpoint with a manipulated botFilename parameter. No authentication is mentioned as a prerequisite, making the attack surface potentially accessible over the network. However, EDDI typically runs inside a Docker container as a non-root user (UID 185), which restricts file access to those readable by that user within the container [1].

Impact

Successful exploitation leads to unauthorized read access to sensitive files inside the container, such as application configuration, logs, or credentials. This could expose API keys or other secrets stored in the container, and aid in reconnaissance. The impact is limited to the container itself; the host system and other containers remain unaffected due to Docker isolation [1].

Mitigation

The vulnerability is patched in version 5.4 of EDDI [1]. Users should upgrade immediately. As a temporary workaround, restrict network access to the /backup/export endpoint using firewall rules or authentication mechanisms [1].