Path Traversal in TaskingAI DALL-E 3 Image Tool

Executive Summary

This is a path traversal vulnerability in TaskingAI v0.3.0's DALL-E 3 image generation tool. The save_url_image function in plugin/app/service/image_storage.py allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter. The function constructs file paths by directly concatenating user-controlled input without validation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for POST requests to /v1/execute with the X-Project-Id header containing path traversal sequences like ../../../. Check server logs for unexpected file writes outside the intended storage directory. Use commands like grep to search for suspicious project_id values in logs or network captures.

Useful 0 Not Useful 0

Impact Analysis

Attackers could overwrite critical system files, plant malicious files, or execute arbitrary code on the server. This could lead to complete system compromise, data theft, or denial of service. The vulnerability is accessible via the POST /v1/execute endpoint using a crafted X-Project-Id header with path traversal sequences like ../../../.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. It enables attackers to write files to arbitrary locations, potentially exposing or modifying regulated data without authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update TaskingAI to a patched version if available. If not, restrict access to the POST /v1/execute endpoint and sanitize the project_id parameter by validating and normalizing paths. Ensure the project_id is confined to the intended storage directory using path containment checks.

Useful 0 Not Useful 0