CVE-2024-10457

Description

Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock.

Reserved 2024-10-28 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-918 Server-Side Request Forgery (SSRF)

Product status

Any version before autogpt-platform-beta-v0.2.1
affected

References

huntr.com/bounties/1d91e1e1-7d45-4bda-bc27-bfe9052fd975

github.com/...ommit/bcaf3241dadfc1fca024e91fb8f2e3004105a172

cve.org (CVE-2024-10457)

nvd.nist.gov (CVE-2024-10457)

Download JSON