Path Traversal in Leon AI Assistant

Executive Summary

This vulnerability is a path traversal issue in the Leon AI project before commit 50df142. It allows attackers to write files outside the intended models directory by using percent-encoded path separators (like %2e%2e%2f for ../) in crafted URLs. The flaw occurs in the getModelFileNameFromURL() function, which processes URLs before properly decoding them, enabling directory traversal.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Leon AI instance is running a vulnerable version (before commit 50df142). Inspect the download command logs for unusual file paths or writes outside the models directory. Look for URLs containing encoded path separators like %2e%2e%2f or %2f in download requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker could trick a user into running '/download model' with a malicious URL, causing the system to write files to arbitrary locations writable by Leon. This could lead to overwriting system files, executing arbitrary code, or corrupting data. The impact depends on the permissions of the Leon process.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Leon AI to commit 50df142 or later. If updating is not possible, disable the /download model command or restrict network access to the Leon instance. Monitor file system writes to detect unauthorized file creation outside the models directory.

Useful 0 Not Useful 0