ExploitCVE-2024-6331
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary
A vulnerability in stitionai/devika main branch (as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f) allows Local File Read (LFI) through Prompt Injection. This is due to the integration of Google Gimini 1.0 Pro with `HarmBlockThreshold.BLOCK_NONE` for `HarmCategory.HARM_CATEGORY_HATE_SPEECH` and `HarmCategory.HARM_CATEGORY_HARASSMENT` in `safety_settings`, which disables content protection.
Impact
This vulnerability allows malicious actors to execute unauthorized commands, potentially leading to the exposure of sensitive information. For example, attackers could read sensitive file contents like `/etc/passwd`. The confidentiality impact is rated as HIGH, while integrity and availability impacts are NONE. The overall CVSS v3.1 base score is 6.5, categorized as HIGH severity.
Exploitation
One proof-of-concept exploit is available on huntr.com. There is no evidence of proof of exploitation at the moment.
Patch
As of the provided information, there is no mention of an available patch. The vulnerability affects the main branch of stitionai/devika from May 2, 2024 onwards (versionStartIncluding: "2024-05-02").
Mitigation
While no specific mitigation is mentioned, security teams should consider the following: 1. Review and adjust the `safety_settings` in Google Gimini 1.0 Pro integration, particularly for `HarmCategory.HARM_CATEGORY_HATE_SPEECH` and `HarmCategory.HARM_CATEGORY_HARASSMENT`. 2. Implement proper input validation and sanitization to prevent prompt injection attacks. 3. Limit access to sensitive files and implement strict access controls. 4. Monitor for any suspicious activities or unauthorized file access attempts. 5. Keep the stitionai/devika software updated to the latest secure version when available.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Timeline
NVD published the first details for CVE-2024-6331
Feedly found the first article mentioning CVE-2024-6331. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.4%)
A CVSS base score of 6.5 has been assigned.