CVE-2025-0454
SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt
A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the `urlparse` function from the `urllib.parse` library and the `requests` library. A malicious user can exploit this by submitting a specially crafted URL, such as `http://localhost:\@google.com/../`, to bypass the SSRF check and perform an SSRF attack.
Reserved 2025-01-13 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-918 Server-Side Request Forgery (SSRF)
huntr.com/bounties/0664fdee-bdc2-4650-8075-74d7b8d3e308
github.com/...ommit/ff065cd24c2289878c0abdb9adbf91c305f0d70a
Support options
