Описание
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API
Summary
An unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the agent_file field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs.
Details
The agent_file field in JobSubmitRequest accepts any filesystem path with no validation:
The executor reads the file directly:
Proof of Concept
Server responds with contents of /etc/passwd.
Other exploitable paths:
/proc/1/environ— environment variables, API keys/home//.ssh/id_rsa— SSH private keys/app/.env— application secrets
Impact
Any unauthenticated attacker with network access to port 8005 can read any file accessible to the server process, including credentials, private keys, and environment variables.
Пакеты
praisonai
< 4.6.59
4.6.59
Связанные уязвимости
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. This vulnerability is fixed in 4.6.59.