SillyTavern Path Traversal Vulnerability Allows File Read/Delete
Overview
SillyTavern, a local AI interaction UI, is susceptible to a path traversal vulnerability in its chat endpoints before version 1.17.0. This flaw allows an authenticated attacker to exploit the `avatar_url` parameter to read or delete arbitrary files within the user's data directory. By crafting a malicious payload such as `avatar_url='..'`, an attacker can navigate outside the intended file access boundaries. This could lead to the exposure or deletion of sensitive configuration files like `secrets.json` and `settings.json`, compromising user credentials, API keys, or other critical data. The vulnerability's impact is significant as it affects the integrity and confidentiality of user-specific data stored by SillyTavern. Successful exploitation requires prior authentication to the SillyTavern instance.
Affected Systems
Testing Guide
1. Ensure you are running a version of SillyTavern prior to 1.17.0. 2. Authenticate to your SillyTavern instance. 3. Attempt to send a chat message with a crafted `avatar_url` parameter, e.g., `avatar_url='../secrets.json'` or a path leading to another sensitive file within your user data root. 4. Observe if the application returns the content of the specified file or attempts to delete it, indicating successful exploitation.
Mitigation Steps
- Update SillyTavern to version 1.17.0 or later. - Implement stricter input validation on the `avatar_url` parameter to prevent directory traversal sequences. - Restrict file access permissions for the SillyTavern process to the minimum necessary. - Regularly review and audit user data directories for suspicious file access patterns.
Patch Details
Version 1.17.0