| Titolo | EKKOLearnAI hermes-studio (renamed to ekko-studio) through 1.0.6 Authenticated Arbitrary File Write in Media Generation API Leads |
|---|
| Descrizione | An authenticated arbitrary file write vulnerability exists in hermes-studio (renamed to ekko-studio). The image/video generation endpoint POST /api/studio/media/apikey-image-generate accepts a user-controlled output_path parameter and passes it directly to writeFileSync without any path validation, allowing a logged-in user to write files to any location on the server filesystem. This can be escalated to remote code execution.Root CauseFile: packages/server/src/modules/studio/controllers/media.ts~line 676, user input passed through without validation:const requestedOutputPath = typeof body.output_path === 'string' ? body.output_path.trim() : ''const outputPaths = saveGeneratedImages(images, requestedOutputPath || undefined)~line 619, written straight to disk inside saveGeneratedImages():mkdirSync(dirname(outputPath), { recursive: true })writeFileSync(outputPath, Buffer.from(image, 'base64'))No normalization, no rejection of ../ segments or absolute paths, no containment check against the profile/workspace directory. The video download path (downloadVideo) in the same controller has the same flaw.Why this is a bug, not intended behaviorThe file manager endpoint in the same codebase (PUT /api/studio/files/write) treats a user-supplied path as a security boundary with four protections: requireSuperAdmin role restriction, isSensitivePath blocklist, resolveProfileFilePath traversal rejection, and isPathWithin containment check. The media generation endpoint applies none of these and requires only a regular logged-in user. This inconsistency indicates the validation was missed, not deliberately omitted.ImpactAn authenticated (non-admin) user can overwrite or create files at arbitrary filesystem locations with server privileges. Overwriting files that the host later executes or loads (scheduled tasks, startup entries, application code) leads to remote code execution. On shared deployments this also breaks per-user workspace isolation.Verified VersionsVerified on current main branch and release v1.0.6. The unvalidated write has existed since at least v0.7.31. Confirmed working by the author.Public ReferencePublic issue report (semi-public channel via GitHub issue, per submission policy):https://github.com/EKKOLearnAI/ekko-studio/issues/3319CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (8.1 High)CWE-73 (External Control of File Name or Path), secondary CWE-22 (Path Traversal)Suggested FixRoute output_path through the same containment checks used by files/write (resolveProfileFilePath / isPathWithin), or drop user-supplied paths and always write into the default media directory.Researcher credit: SSDDZX |
|---|
| Fonte | ⚠️ https://github.com/EKKOLearnAI/ekko-studio/issues/3319 |
|---|
| Utente | test008 (UID 99871) |
|---|
| Sottomissione | 08/10/2026 08:46 (29 giorni fa) |
|---|
| Moderazione | 21/10/2026 13:18 (13 days later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 424736 [EKKOLearnAI ekko-studio fino a 1.0.6 Media Generation API media.ts saveGeneratedImages output_path escalationi di privilegi] |
|---|
| Punti | 20 |
|---|