Executive Summary

This vulnerability is a path traversal flaw in AstrBotDevs AstrBot version 4.23.6, specifically in the API endpoint /api/skills/delete. By manipulating the argument 'Name', an attacker can traverse directories outside the intended scope, potentially deleting or accessing unauthorized files or directories on the system. The attack can be performed remotely without user interaction.

A proof of concept exploit demonstrates how an attacker can log into the AstrBot API with hardcoded credentials, obtain an authentication token, and send a crafted request to delete directories outside the allowed path, confirming the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to perform unauthorized deletion or access of files and directories outside the intended scope of the application. This can lead to loss of important data, disruption of service, or unauthorized modification of system files.

Since the attack can be initiated remotely and the exploit is publicly available, it increases the risk of exploitation by malicious actors.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to exploit the path traversal flaw in the /api/skills/delete API endpoint of AstrBot 4.23.6. A proof of concept exploit script named poc_exploit.py demonstrates how to test for this vulnerability by sending a crafted request with a manipulated "name" argument that includes path traversal sequences (e.g., "../").

The detection process involves the following steps:

• Create a test directory on the target system to verify if it can be deleted.
• Use the exploit script to log into the AstrBot API with valid credentials to obtain an authentication token.
• Send a POST request to the /api/skills/delete endpoint with the "name" parameter set to a path traversal payload (e.g., "../poc_target_exploit").
• Check if the test directory was deleted despite being outside the intended directory scope.

In terms of commands, you can use the provided Python script (poc_exploit.py) or manually craft similar HTTP requests using tools like curl or Postman to test the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the path traversal vulnerability in AstrBot 4.23.6 affecting the /api/skills/delete endpoint, immediate steps include restricting or disabling access to this API endpoint to prevent remote exploitation.

Additionally, monitor and audit API usage for suspicious requests attempting directory traversal patterns in the 'Name' argument.

If possible, apply input validation or filtering on the 'Name' parameter to block traversal sequences such as '../'.

Since the vendor has not responded and no patch is available, consider isolating the affected service or applying network-level controls to limit exposure.

Useful 0 Not Useful 0