Cyber Posture

CVE-2024-8524

HighPublic PoC

Published: 20 March 2025

Published
20 March 2025
Modified
15 October 2025
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0093 76.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2024-8524 is a directory traversal vulnerability (CWE-22) affecting modelscope/agentscope version 0.0.4. The flaw allows an attacker to read arbitrary local JSON files on the server by sending a specially crafted POST request to the /read-examples endpoint. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no requirements for privileges or user interaction.

Any unauthenticated remote attacker can exploit this vulnerability over the network without privileges. By crafting a malicious POST request to the exposed /read-examples endpoint, the attacker can traverse directories and access sensitive JSON files anywhere on the local filesystem, potentially exposing configuration data, credentials, or other confidential information stored in JSON format.

Details on mitigation, including any patches or workarounds, are available in the advisory published on Huntr at https://huntr.com/bounties/cc4acf33-700d-4220-8a8a-db28f5c4cc8f. Security practitioners should review this reference for remediation steps specific to modelscope/agentscope.

Details

CWE(s)
CWE-22

Affected Products

modelscope
agentscope
0.0.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

Remote unauthenticated directory traversal in exposed web endpoint directly enables exploitation of public-facing application (T1190) and arbitrary local file reads for data collection (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References