Today > vulnerabilities   -   You can now download lists of IOCs here!

CVE-2024-1879

June 6, 2024, 6:15 p.m.

Tags

CWE-352
security@huntr.dev
2024-06-06
CVE-2024-1879

CVSS Score

8.8 / 10

Product(s) Impacted

significant-gravitas/autogpt

  • v0.5.0

Description

A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.

Weaknesses

Date

Published: June 6, 2024, 6:15 p.m.

Last Modified: June 6, 2024, 6:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

security@huntr.dev

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score
8.8
Exploitability Score
Impact Score
Base Severity
HIGH
CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://github.com/ security@huntr.dev
https://huntr.com/ security@huntr.dev