CVE-2024-10901: Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt
In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as init.py in the Python's /site-packages/ directory.
Other sources
In eosphoros-ai/db-gpt version v0.6.3 and earlier, the web API POST /api/v1/editor/chart/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as init.py in the Python's /site-packages/ directory.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10901?
CVE-2024-10901 is considered a critical vulnerability due to its potential for arbitrary SQL execution and file write capabilities.
How do I fix CVE-2024-10901?
To mitigate CVE-2024-10901, it is recommended to immediately apply access controls to the API endpoint and validate SQL inputs.
What is the impact of CVE-2024-10901?
The impact of CVE-2024-10901 includes potential unauthorized access to sensitive data and the ability for attackers to modify files on the server.
Which versions of db-gpt are affected by CVE-2024-10901?
CVE-2024-10901 affects version v0.6.0 of eosphoros-ai/db-gpt.
Can CVE-2024-10901 be exploited remotely?
Yes, CVE-2024-10901 can be exploited remotely through the vulnerable API without requiring prior access.