Local File Inclusion Vulnerability in ModelScope AgentScope

CVE-2024-8550

What is CVE-2024-8550?

A Local File Inclusion vulnerability exists in the /load-workflow endpoint of ModelScope's AgentScope version 0.0.4. This flaw permits attackers to exploit the filename parameter, allowing unauthorized access to arbitrary files on the server, including sensitive information like API keys. The vulnerability stems from insufficient sanitization of user inputs passed to the os.path.join function, creating an opportunity for file traversal attacks and exposure of critical files outside the designated directory.

References