Description
A local file read vulnerability exists in the stitionai/devika repository, affecting the latest version. The vulnerability is due to improper handling of the 'snapshot_path' parameter in the '/api/get-browser-snapshot' endpoint. An attacker can exploit this vulnerability by crafting a request with a malicious 'snapshot_path' parameter, leading to arbitrary file read from the system. This issue impacts the security of the application by allowing unauthorized access to sensitive files on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| stitionai | stitionai/devika | unspecified – < - | - |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Devika - Local File Inclusion http/cves/2024/CVE-2024-5334.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.