CVE-2024-40422 PoC — Devika 安全漏洞

Source

https://github.com/j3r1ch0123/CVE-2024-40422

Associated Vulnerability

Title:Devika 安全漏洞 (CVE-2024-40422)
Description:The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshot_path parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized access to critical system files and compromise the confidentiality and integrity of the system.

Description

Found this on exploit-db, decided to make my own for practice. This exploit will search out the passwd file and print the contents on a vulnerable system.

Readme

# CVE-2024-40422
Found this on exploit-db, decided to make my own for practice. This exploit will search out the passwd file and print the contents on a vulnerable system.

pip install requests

You can read more on the vulnerability here:
https://medium.com/aardvark-infinity/cve-2024-40422-path-traversal-vulnerability-in-stitionai-devika-81cbf45718f3

File Snapshot


 [4.0K]  /data/pocs/154feb93203331ba2323052ba9f3723bbbda95aa
├── [1.1K]  exploit.py
└── [ 354]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!