CVE-2024-8958

The vulnerability (CWE-434) lies in the fact that filetools actions in Composio do not properly validate paths provided by the user. An attacker can pass crafted paths (e.g., using path traversal sequences) to gain access to arbitrary locations in the server's file system. By leveraging the ability to write files to selected locations, an attacker can, for example, replace configuration files, startup scripts, or place malicious executable code, which can consequently lead to taking control of the server.

An attacker can read sensitive data stored on the server (including credentials, private keys) and write malicious files to any location on the system, enabling privilege escalation or full remote code execution on the server.

Apply patches available from the vendor according to the references. Additionally, it is recommended to restrict network access to the Composio instance exclusively to trusted hosts and monitor activity in the filetools module until the update is deployed.

Composio (composiohq/composio) version 0.4.3