Path Traversal Vulnerability in Network-AI Before 5.15.5

Executive Summary

A path traversal vulnerability was discovered in Network-AI before version 5.15.5. This vulnerability allows attackers to escape the base directory using sibling-directory paths, potentially leading to unauthorized file access. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity.

Technical Analysis

The vulnerability exists in the `InputSanitizer.sanitizePath()` function of Network-AI. An attacker can supply paths whose directory name shares a string prefix with the base directory, bypassing the unanchored `startsWith` check. This allows attackers to read, list, or write files outside the sandbox.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by supplying a crafted path to the `InputSanitizer.sanitizePath()` function. The attacker would need to provide a path whose directory name shares a string prefix with the base directory, allowing them to escape the sandbox and access files outside the intended directory. For example, if the base directory is `/sandbox/user`, an attacker could provide a path like `/sandbox/user/../../../etc/passwd` to access the `/etc/passwd` file.

Impact Assessment

The vulnerability affects Network-AI versions before 5.15.5. Successful exploitation could allow an attacker to read, list, or write files outside the sandbox, potentially leading to unauthorized file access or modification. The CVSS score for this vulnerability is 7.5, indicating a HIGH severity level.

Recommended Actions

To mitigate this vulnerability, users should update Network-AI to version 5.15.5 or later. Additionally, users can implement input validation and sanitization to prevent similar attacks. It is also recommended to monitor the Network-AI installation for suspicious activity and implement additional security measures to prevent exploitation.

Sources

- National Vulnerability Database (NVD) - Vulncheck - GitHub Security Advisories