// For flags

CVE-2024-1879

CSRF to RCE in significant-gravitas/autogpt

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a user running AutoGPT in their local network to a malicious website. This site can then send crafted requests to the AutoGPT server, leading to command execution. The issue is exacerbated by CORS being enabled for arbitrary origins by default, allowing the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.

Una vulnerabilidad de Cross-Site Request Forgery (CSRF) en la versión v0.5.0 de significant-gravitas/autogpt permite a los atacantes ejecutar comandos arbitrarios en el servidor AutoGPT. La vulnerabilidad se debe a la falta de protección en el endpoint API que recibe instrucciones, lo que permite a un atacante dirigir a un usuario que ejecuta AutoGPT en su red local a un sitio web malicioso. Luego, este sitio puede enviar solicitudes manipuladas al servidor AutoGPT, lo que lleva a la ejecución del comando. El problema se ve agravado por el hecho de que CORS está habilitado para orígenes arbitrarios de forma predeterminada, lo que permite al atacante leer la respuesta de todas las consultas entre sitios. Esta vulnerabilidad se solucionó en la versión 5.1.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
Poc
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-02-26 CVE Reserved
  • 2024-06-06 CVE Published
  • 2024-08-21 CVE Updated
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Agpt
Search vendor "Agpt"
 Autogpt
Search vendor "Agpt" for product "Autogpt"
*-
Affected
Significant-gravitas
Search vendor "Significant-gravitas"
 Autogpt
Search vendor "Significant-gravitas" for product "Autogpt"
*-
Affected