Attack Chain

1. Attacker crafts a malicious input containing a traversal payload (e.g., user_id: "../../etc/cron.d/malicious") within an agent job submission.
2. The agents_generator.py service parses the user-submitted agent_yaml and extracts the memory configuration.
3. The Agent constructor is invoked, passing the attacker-controlled user_id to the FileMemory class.
4. The FileMemory.__init__ method concatenates the malicious user_id with the base_path using Python's pathlib join operator.
5. The application calls mkdir on the constructed path, creating the directory structure on the filesystem if it does not exist.
6. The FileMemory instance performs file operations (e.g., add_short_term), resulting in the creation of JSON files (e.g., short_term.json) at the attacker-specified target location.
7. Successful execution results in unauthorized file writes, potentially allowing an attacker to overwrite sensitive system configurations or package files.

Impact

Successful exploitation allows attackers to perform arbitrary file writes on the host system running the PraisonAI service. Impacts include Denial of Service by disk filling, overwriting critical application configuration files to alter runtime behavior, or attempting to leverage the file write to achieve persistence or code execution by overwriting startup scripts, cron tasks, or system files if the service process runs with sufficient privileges. This is particularly critical in multi-tenant environments where one user could overwrite the memory data or configurations belonging to another user.

Recommendation

• Upgrade praisonaiagents to version 1.6.58 or later to incorporate necessary sanitization patches.
• Implement strict input validation on user_id parameters in any application code interacting with FileMemory to ensure they only contain alphanumeric characters, underscores, and hyphens.
• Apply the principle of least privilege to the service account executing PraisonAI agents to minimize the impact of arbitrary file writes on system-level directories.
• If immediate patching is not possible, implement a proxy or validation layer to scan agent_yaml inputs for directory traversal patterns before processing.