CVE-2024-47170: Agnai File Disclosure Vulnerability: JSON via Path Traversal

September 26, 2024

A vulnerability has been discovered in Agnai that permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information and exposure of confidential configuration files. This only affects installations with JSON_STORAGE enabled which is intended to local/self-hosting only.

References

github.com/advisories/GHSA-h355-hm5h-cm8h
github.com/agnaistic/agnai
github.com/agnaistic/agnai/security/advisories/GHSA-h355-hm5h-cm8h
nvd.nist.gov/vuln/detail/CVE-2024-47170

Code Behaviors & Features

Detect and mitigate CVE-2024-47170 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →