| शीर्षक | composiohq composio <=v0.5.8(latest) arbitrary file read |
|---|
| विवरण | Without checking the path in this directory, information on this machine can be read. If the user starts the Composio Server service with root permissions, it may be possible to read sensitive files such as /root/.ssh/id_rsa, which are used for SSH key-based authentication, potentially allowing keyless login to the server.
The vulnerability lies in the composio\server\api.py file where there is no restriction placed on the path() function. |
|---|
| स्रोत | ⚠️ https://rumbling-slice-eb0.notion.site/There-is-an-arbitrary-file-read-vulnerability-at-api-download-in-composiohq-composio-f0ec1ec26a5f434a97bb1ffde435a35b?pvs=4 |
|---|
| उपयोगकर्ता | aftersnow (UID 71336) |
|---|
| सबमिशन | 05/09/2024 02:33 PM (2 साल पहले) |
|---|
| संयम | 14/09/2024 07:56 AM (9 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 277502 [composiohq composio तक 0.5.8 composio\server\api.py path file निर्देशिका ट्रैवर्सल] |
|---|
| अंक | 17 |
|---|