Devika AI is a web application used for web scraping and browser automation.
This vulnerability exists due to improper handling of user input in the snapshot_path parameter. An attacker can exploit this vulnerability to read arbitrary files on the system by crafting a malicious request.
The vulnerability is located in the /api/get-browser-snapshot endpoint of the Devika AI application. The snapshot_path parameter is not properly validated, allowing attackers to specify a path to a file they want to read.
Successful exploitation of this vulnerability could allow an attacker to read sensitive information from the server, such as configuration files or user data. This information could then be used to launch further attacks on the system.
References:
- Ensure input validation is implemented to prevent malicious file inclusions.
- Use whitelists for allowed file paths.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →