CVE-2024-10901: Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt
First published: Thu Mar 20 2025(Updated: )
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as `__init__.py` in the Python's `/site-packages/` directory.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| eosphoros-ai db-gpt | ||
| pip/dbgpt | <=0.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://huntr.com/bounties/db2c1d59-6e3a-4553-a1f6-94c8df162a18
- https://nvd.nist.gov/vuln/detail/CVE-2024-10901
- https://github.com/eosphoros-ai/DB-GPT/pull/2269
- https://github.com/eosphoros-ai/DB-GPT/commit/295cdb8723663d5b0954d5d1dfb4f02b7223b8ff
- https://github.com/advisories/GHSA-7gj6-22m4-qfhx (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-10901?
CVE-2024-10901 is considered a critical vulnerability due to its potential for arbitrary SQL execution and file write capabilities.
How do I fix CVE-2024-10901?
To mitigate CVE-2024-10901, it is recommended to immediately apply access controls to the API endpoint and validate SQL inputs.
What is the impact of CVE-2024-10901?
The impact of CVE-2024-10901 includes potential unauthorized access to sensitive data and the ability for attackers to modify files on the server.
Which versions of db-gpt are affected by CVE-2024-10901?
CVE-2024-10901 affects version v0.6.0 of eosphoros-ai/db-gpt.
Can CVE-2024-10901 be exploited remotely?
Yes, CVE-2024-10901 can be exploited remotely through the vulnerable API without requiring prior access.
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7gj6-22m4-qfhx
- alias/CVE-2024-10901
- collector/nvd-cve
- agent/last-modified-date
- agent/weakness
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- vendor/eosphoros-ai
- canonical/eosphoros-ai db-gpt
- package-manager/pip