Executive Intelligence Brief

A critical vulnerability (CVSS 8.7) has been discovered in the Khoj application, specifically in the /home/ endpoint. This endpoint is vulnerable to unauthenticated path traversal attacks, allowing attackers to read arbitrary files from the server filesystem. The vulnerability exists due to the lack of path traversal filtering, path normalization checks, and authentication mechanisms. Successful exploitation can lead to the exposure of sensitive data, including application configurations and system files.

The affected technology is the Khoj application, which has a significant deployment footprint in various environments. The vulnerability's severity is high, and immediate action is recommended to mitigate potential attacks.

Recommendation: Apply the recommended fixes, including using FastAPI's built-in StaticFiles mount or adding explicit path validation, to prevent exploitation.

Threat Overview

The Khoj application is affected by a critical vulnerability in its /home/ endpoint. This endpoint serves static files by directly concatenating the user-supplied file path with a constant home directory. The lack of path traversal filtering, path normalization checks, and authentication mechanisms makes it vulnerable to unauthenticated path traversal attacks.

The vulnerability's impact is significant, as it allows attackers to read arbitrary files from the server filesystem, including application configurations, system files, and sensitive data. This can facilitate further attacks, such as exploiting leaked credentials for deeper compromise.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as a path traversal vulnerability (CWE-22). This class of vulnerability occurs when an application does not properly validate and sanitize user-supplied input, allowing attackers to traverse the filesystem and access sensitive files.

The CVSS vector details are not explicitly provided, but the CVSS score is 8.7, indicating a high severity vulnerability.

Root Cause Analysis

The fundamental coding flaw is the lack of path traversal filtering, path normalization checks, and authentication mechanisms in the /home/ endpoint. The vulnerable code directly concatenates the user-supplied file path with the home directory constant, allowing attackers to use ../ sequences to read arbitrary files.

The affected component is the web_client.py file, specifically lines 46-49.

Attack Vector & Chain

The attack vector involves sending a GET request to the /home/ endpoint with a malicious file path. The preconditions are that the attacker has network access to the Khoj instance and can send HTTP requests to the vulnerable endpoint.

No authentication is required, making it exploitable by any network-reachable attacker.

Exploitation Scenario Walkthrough

Scenario: Unauthenticated Path Traversal via /home/ Endpoint

Reconnaissance: An attacker discovers the vulnerable Khoj instance and identifies the /home/ endpoint as a potential target.

Weaponization: The attacker crafts a malicious file path using ../ sequences to traverse the filesystem and access sensitive files.

Delivery & Exploitation: The attacker sends a GET request to the /home/ endpoint with the malicious file path. For example: curl http://localhost:42110/home/../../../../../../../etc/passwd

Post-Exploitation: The attacker can read sensitive files, including application configurations, system files, and sensitive data. This can facilitate further attacks, such as exploiting leaked credentials for deeper compromise.

Impact Realization: The attacker can exfiltrate sensitive data, including application configurations, system files, and any file readable by the server process.

Exploitation in the Wild

The vulnerability is not actively exploited at the time of disclosure. However, given the severity and ease of exploitation, it is likely that attackers will target this vulnerability in the future.

Impact Analysis

Direct Impact

The direct impact of the vulnerability is the ability for an attacker to read arbitrary files from the server filesystem, including application configurations, system files, and sensitive data.

The impact can be quantified as follows:

  • Read application configuration: Django SECRET_KEY, database credentials, API keys
  • Read system files: /etc/passwd, /etc/shadow (if permissions allow), /proc/self/environ
  • Exfiltrate sensitive data: Any file readable by the server process
  • Facilitate further attacks: Leaked credentials enable deeper compromise

Downstream & Cascading Effects

The downstream and cascading effects of the vulnerability include:

  • Supply chain risk: If the Khoj application is used in a supply chain, the vulnerability can be exploited to gain access to sensitive data or facilitate further attacks.
  • Regulatory implications: The exposure of sensitive data can lead to regulatory issues, such as GDPR or HIPAA violations.
  • Customer data exposure: If sensitive customer data is stored in files accessible by the vulnerable endpoint, it can be exfiltrated by an attacker.
  • Operational disruption: The exploitation of the vulnerability can lead to operational disruption, as sensitive data is exfiltrated or system files are accessed.

Affected Products & Versions

The affected product is the Khoj application, specifically versions prior to 2.0.0-beta.25.

The fixed version is 2.0.0-beta.25, which includes the recommended fixes.

Detection & Threat Hunting

Indicators of Compromise

The indicators of compromise include:

  • Unusual requests to the /home/ endpoint
  • Access to sensitive files, such as /etc/passwd or application configuration files
  • Unusual network activity, such as exfiltration of sensitive data

Detection Rules & Signatures

The detection rules and signatures include:

  • Monitoring the /home/ endpoint for unusual requests
  • Detecting access to sensitive files
  • Identifying unusual network activity

Relevant MITRE ATT&CK techniques and tactics include:

  • T1190: Exploit Public-Facing Application
  • T1203: Exploitation for Credential Access
  • T1213: Data from Local System

Threat Hunting Queries

The threat hunting queries include:

  • Searching for unusual requests to the /home/ endpoint in web logs
  • Identifying access to sensitive files in system logs
  • Detecting unusual network activity in network logs

Remediation & Hardening

Immediate Actions (0-24 hours)

The immediate actions include:

  • Applying the recommended fixes, including using FastAPI's built-in StaticFiles mount or adding explicit path validation
  • Monitoring the /home/ endpoint for unusual requests
  • Detecting access to sensitive files

Short-Term Hardening (1-7 days)

The short-term hardening actions include:

  • Implementing additional security controls, such as network segmentation or WAF rules
  • Enhancing monitoring and detection capabilities
  • Conducting a thorough review of the Khoj application's security posture

Strategic Recommendations

The strategic recommendations include:

  • Implementing a robust security testing program to identify vulnerabilities
  • Conducting regular security audits and penetration testing
  • Enhancing incident response capabilities

Analyst Assessment

The analyst assessment is that the vulnerability is critical and requires immediate attention. The likelihood of exploitation is high, given the severity and ease of exploitation. The risk of inaction is significant, as exploitation can lead to sensitive data exposure and further attacks.

Sources

  • GitHub Security Advisories: GHSA-62mm-xwmv-crhg