EDDI Backup Export Path Traversal Attempt

How the attack works

The attacker sends a request to the /backup/export endpoint and puts a path-traversal sequence (like ../../etc/passwd or its URL-encoded equivalents) into the botFilename parameter, either in the query string or the request body. Because the server does not clean this input, it walks up out of the export directory and reads whatever file the path points to. The response then hands back the contents of that file, such as environment variables, container configuration, or application secrets. The attack works with plain ../ sequences as well as encoded, double-encoded, and overlong UTF-8 variants designed to slip past naive filters.

Netzilo detection

Why it matters

An attacker can read files from inside the E.D.D.I container's filesystem, exposing secrets, configuration, and environment data that should not be accessible. The damage is limited to what's inside the container, but that can still include credentials used elsewhere.

What you can do

• →Upgrade E.D.D.I to version 5.4 or later, which fixes the botFilename sanitisation bug.
• →If upgrading isn't immediately possible, block or restrict access to the /backup/export endpoint at the network or reverse-proxy layer.
• →Review container secrets and environment variables for sensitivity, and avoid storing high-value credentials directly in the container filesystem.
• →When investigating alerts, check for change-ticket or pentest authorization context before treating every match as a real attack, since authorized security testing produces identical payloads.

Known benign look-alikes

• Authorised DAST / penetration-test tooling driven through the agent against an internal EDDI instance — the payload is byte-identical to a real attack and can only be distinguished by change-ticket context.
• A security engineer asking the agent to reproduce the public proof-of-concept for this CVE against a lab bot; the advisory-text filter only suppresses this when the request body also carries the words "CVE-" and "path traversal".
• OpenAPI / Swagger specification bodies that document the botFilename parameter with an escaped example value (suppressed by filter_api_spec and filter_placeholder).
• A genuine bot export whose filename legitimately contains a double dot immediately followed by a slash or backslash (e.g. "archive../nightly.json") — extremely rare, since the regex requires the dots to be adjacent to a separator or its encoding.

References

• https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• https://cwe.mitre.org/data/definitions/22.html
• https://github.com/labsai/EDDI