CVE-2024-10457: SSRF Vulnerabilities in significant-gravitas/autogpt
Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10457?
CVE-2024-10457 is classified as a moderate severity vulnerability due to its potential for exploiting server-side request forgery.
How do I fix CVE-2024-10457?
To mitigate CVE-2024-10457, users should update to the latest version of the autogpt software where the SSRF vulnerabilities have been fixed.
Which software is affected by CVE-2024-10457?
CVE-2024-10457 affects the Significant Gravitas autogpt software, specifically version agpt-platform-beta-v0.1.1.
What types of vulnerabilities are present in CVE-2024-10457?
CVE-2024-10457 contains multiple server-side request forgery (SSRF) vulnerabilities.
What are the potential impacts of CVE-2024-10457?
Exploitation of CVE-2024-10457 could allow an attacker to make unauthorized requests from the server, potentially exposing sensitive data.