frdel Agent-Zero Directory Traversal Vulnerability in download_work_dir_file API

A directory traversal vulnerability has been identified in frdel Agent-Zero versions 0.8.0 through 0.9.4. This issue allows unauthenticated attackers to exploit the 'path' parameter in the 'download_work_dir_file' API, enabling them to download arbitrary files from the server. The vulnerability arises because the application does not properly validate file paths, allowing for traversal sequences that can access sensitive files.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Reproduction

To reproduce this vulnerability, send a request to the 'download_work_dir_file' API with a crafted 'path' parameter that includes directory traversal sequences. For example, using '../' sequences to navigate the file system and access restricted files such as '/etc/passwd'.

Remediation

Users are advised to upgrade to Agent-Zero version 0.8.4.1, which addresses this vulnerability.