CVE-2024-6331

Опубликовано: 04 авг. 2024

Источник: nvd

CVSS3: 7.5

CVSS3: 6.5

EPSS Низкий

Описание

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with HarmBlockThreshold.BLOCK_NONE for HarmCategory.HARM_CATEGORY_HATE_SPEECH and HarmCategory.HARM_CATEGORY_HARASSMENT in safety_settings disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like /etc/passwd.

Ссылки

https://huntr.com/bounties/d5ac1051-22fa-42f0-8d82-73267482e60f
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:stitionai:devika:*:*:*:*:*:*:*:*

Версия от 2024-05-02 (включая)

EPSS

Процентиль: 44%

0.0022

Низкий

7.5 High

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-74

Связанные уязвимости

GHSA-699f-m7wm-gv75

CVSS3: 7.5

github

больше 1 года назад

stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f is vulnerable to Local File Read (LFI) by Prompt Injection. The integration of Google Gimini 1.0 Pro with `HarmBlockThreshold.BLOCK_NONE` for `HarmCategory.HARM_CATEGORY_HATE_SPEECH` and `HarmCategory.HARM_CATEGORY_HARASSMENT` in `safety_settings` disables content protection. This allows malicious commands to be executed, such as reading sensitive file contents like `/etc/passwd`.

EPSS

Процентиль: 44%

0.0022

Низкий

7.5 High

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-74