Directory Traversal in agent-zero File Browser

Executive Summary

The vulnerability in agent-zero versions 1.7 to 1.10 allows a Directory Traversal attack through the FileBrowser.save_file_b64 function. This function accepts user-controlled file paths without proper validation or normalization, enabling attackers to traverse outside intended directories and write files to arbitrary locations on the system.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems running agent-zero versions 1.7 to 1.10 for unusual file writes or unauthorized file access patterns. Check logs for requests to python/helpers/file_browser.py with base64-encoded file paths containing '..' or absolute paths. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to overwrite critical system files, plant malicious scripts, or access sensitive data by writing files to unintended locations. It may lead to remote code execution, data corruption, or unauthorized system access depending on the attacker's goals.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially lead to unauthorized file access or modification, which may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) or HIPAA (e.g., unauthorized access to protected health information). However, specific compliance impacts depend on how the affected software is used in a given environment.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade agent-zero to a patched version beyond 1.10. If upgrading is not possible, restrict access to the FileBrowser.save_file_b64 endpoint and validate all file paths to prevent traversal sequences like '..'. Monitor for suspicious file operations in the application directory.

Useful 0 Not Useful 0