CVE-2024-10906: Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt
In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10906?
CVE-2024-10906 is classified as a high-severity vulnerability due to its potential for unauthorized access to all endpoints.
How do I fix CVE-2024-10906?
To fix CVE-2024-10906, update the CORS middleware configuration to restrict the `Access-Control-Allow-Origin` header to trusted origins.
What software versions are affected by CVE-2024-10906?
CVE-2024-10906 affects eosphoros-ai/db-gpt version 0.6.0 and below.
What does CVE-2024-10906 expose my application to?
CVE-2024-10906 exposes the application to cross-origin resource sharing (CORS) vulnerabilities, allowing malicious sites to access sensitive data.
What is the main cause of CVE-2024-10906?
The main cause of CVE-2024-10906 is the use of an overly permissive instance of `CORSMiddleware` that allows all origins.