README.md

DB-GPT v0.8.0 — Unauthenticated arbitrary file write (path traversal / absolute path) — huntr PoC

Private/gated proof-of-concept accompanying a huntr vulnerability report. Access is granted only to the huntr triage bot.

Target: eosphoros-ai/DB-GPT @ v0.8.0 (commit a3f21350, latest release).

An unauthenticated POST /api/v1/python/file/upload passes the raw multipart filename straight into os.path.join(upload_dir, file.filename) with no sanitization, then open(file_path,"wb").write(content). An absolute-path filename (/tmp/evil) or ../ traversal escapes the intended <work_dir>/python_uploads/<user_id>/ confinement and writes attacker-controlled bytes to an attacker-chosen path — anywhere the DB-GPT service user can write.

Contents

• README.md — this file.
• REPORT.md / POC.md — the vulnerability report and walkthrough (added separately).
• poc/fire_005.py — self-contained deterministic PoC. Run network-isolated:

  unshare --user --map-root-user --net python3 poc/fire_005.py
  

• poc/vendor/python_upload_api.py — the real v0.8.0 source file the PoC AST-extracts and executes (the python_file_upload handler with the untouched os.path.join sink), byte-identical to the released PyPI wheel dbgpt-app==0.8.0 — sha256 in poc/PROVENANCE.txt (7eb363ff…, verified at runtime).
• poc/sandbox_005.log — a recorded run: Oracle A (absolute-path escape) + Oracle B (.. traversal) + NEG-CONTROL (benign filename stays confined) all PASS.

Harmless marker only (short text files, cleaned up); no network egress; the target repository is never built or installed.