Executive brief
Agnai is a character AI roleplay application. An authenticated attacker can upload arbitrary JavaScript files to arbitrary server locations by exploiting insufficient validation of file upload parameters and directory paths, leading to remote code execution and complete server compromise. This affects publicly hosted installations that do not use S3-compatible storage.
Technical details
The vulnerability combines path traversal (CWE-35) and unrestricted file upload (CWE-434). In the POST /api/chat/{chatId}/temp-character endpoint, the _id parameter is not validated and is directly used to construct file paths. Combined with the entityUploadBase64 function that does not sanitize filenames or validate file types, an authenticated attacker can upload base64-encoded JavaScript files to arbitrary locations (e.g., /../../../../../../app/srv/api/voice). When the application or Node.js process loads these files, the malicious JavaScript executes with server privileges. The attack requires prior authentication but no additional user interaction. Patch version 1.0.330 and later address this vulnerability.
Affected products
- Agnaistic Agnai before 1.0.330
Timeline
- 2024-09-26: disclosed
- 2024-09-26: patched: Version 1.0.330 and later