ModelScope AgentScope Arbitrary File Download Vulnerability in rpc_agent_client Component

A vulnerability allowing arbitrary file download has been identified in the rpc_agent_client component of ModelScope AgentScope version 0.0.4. This issue enables any user to download files from the host of the rpc_agent by exploiting the download_file method. The vulnerability could result in unauthorized access to sensitive information such as configuration files, credentials, and potentially system files, which might be used for further exploitation, including privilege escalation or lateral movement within the network.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files, including configuration files, credentials, and system files, which could be used to escalate privileges or move laterally within a network.