CVE-2024-8550 Details
Description
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API keys, by manipulating the filename parameter. The issue arises due to improper sanitization of user input passed to the os.path.join function, which can be exploited to access files outside the intended directory.
A local file inclusion (LFI) vulnerability has been identified in the Modelscope Agentscope application, specifically in version 0.0.4. The issue arises in the '/load-workflow' endpoint, where improper sanitization of user input allows attackers to manipulate the filename parameter and read arbitrary files from the server. This vulnerability can be exploited to access sensitive files, such as API keys, by leveraging the os.path.join function to navigate outside the intended directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea | CISA-ADP | ExploitThird Party Advisory |
| https://huntr.com/bounties/7cd8f519-7c75-4936-889d-a17ea1bcb3ea | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| modelscope agentscope | 0.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2025 | Initial Analysis | [email protected] |
| Feb 11, 2025 | CVE Modified | CISA-ADP |
| Feb 10, 2025 | New CVE Received | [email protected] |