Attack Chain

1. Attacker performs network reconnaissance to identify a reachable Khoj instance.
2. Attacker interacts with the /home/ endpoint via an HTTP GET request.
3. Attacker crafts a malicious URI containing path traversal sequences (e.g., ../../../etc/passwd).
4. The application logic in 'web_client.py' concatenates the malicious path to the base directory without validation.
5. The underlying operating system resolves the traversal sequences to a target file path outside the web directory.
6. The 'FileResponse' object retrieves the content of the unintended file.
7. The application returns the contents of the requested file in the HTTP response body, leading to information disclosure.

Impact

Successful exploitation allows unauthenticated remote attackers to read any file on the server accessible to the application process. This includes sensitive data such as database credentials, API keys, application secrets (e.g., Django SECRET_KEY), and system-level files like '/etc/passwd' or '/proc/self/environ'. Access to these files can lead to complete service compromise, facilitate further lateral movement, or allow the attacker to gain persistent unauthorized access to the environment.

Recommendation

1. Upgrade to a version of Khoj patched against this vulnerability (>= 2.0.0-beta.25).
2. Implement a WAF or reverse proxy rule to block or sanitize incoming HTTP requests containing directory traversal sequences (e.g., ../) in the /home/ URI path.
3. Apply the suggested code-level patch to 'src/khoj/routers/web_client.py' by adding path resolution and validation logic that verifies the requested file remains within the intended base directory.
4. Deploy the suggested Sigma rule to monitor for suspicious traversal patterns in web server logs.