Horizon Alert
Summary of the vulnerability and why it matters
A path traversal vulnerability has been identified in SoftVC VITS Singing Voice Conversion software that could allow unauthenticated remote attackers to access and modify files on the server. The issue lies within the audio processing function, where specially crafted requests can lead to the reading of arbitrary files and the writing of malicious files to any location on the filesystem.
- Attackers can read and write server files.
- It impacts an open audio processing service.
- Confirm relevance and exposure of the service.
Attack Path
How an attacker could exploit the issue
An attacker can remotely read arbitrary files and write files to any location on the server. This is achieved by sending a specially crafted POST request to the /wav2wav route, which lacks authentication. The request manipulates the audio_path field to reference sensitive files or desired write locations, leading to unintended file operations.
- Unauthenticated remote access required.
- Path traversal via audio_path field.
- Arbitrary file read and write.
Live Threat
Current exploitation, exposure, and threat context
The SoftVC VITS Singing Voice Conversion server could allow unauthenticated remote attackers to read arbitrary files from the system and write files to arbitrary locations. This could occur when an attacker sends a specially crafted POST request to the `/wav2wav` route, including attacker-controlled filesystem paths in the `audio_path` field.
- Arbitrary server files and arbitrary filesystem locations.
- Path traversal allows reading and writing files.
- Sensitive data exfiltration and unauthorized file creation.
Operational Fix
Recommended remediation, mitigation, and detection steps
The SoftVC VITS Singing Voice Conversion tool's inference server, exposed via an unauthenticated POST request, presents a path traversal vulnerability. This issue requires immediate attention from the team responsible for the deployed instance, likely an application or platform team. The first practical move is to identify all deployed instances, assess their network exposure and criticality, and then coordinate remediation efforts with the accountable owner.
- Application or Platform teams own remediation.
- Verify network exposure and instance criticality.
- Plan coordinated patching or containment.
