CVE-2024-8489: CSRF due to overly permissive CORS headers in modelscope/agentscope

Published Mar 20, 2025

Updated

A vulnerability in modelscope/agentscope, specifically in the AgentScope Studio backend server, allows for Cross-Site Request Forgery (CSRF) due to overly permissive CORS headers. This issue affects the latest commit on the main branch (21161fe). The vulnerability permits an attacker to access all backend endpoints, including the api/file endpoint, enabling the reading of arbitrary files on the target's local file system through CSRF.

Affected Software

1 affected component

modelscope agentscope

Event History

Mar 20, 2025

CVE Published

via MITRE·10:09 AM

Data Sourced

via MITRE·10:09 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-8489?

CVE-2024-8489 is a critical vulnerability due to its potential to facilitate Cross-Site Request Forgery attacks.

How do I fix CVE-2024-8489?

To fix CVE-2024-8489, update the AgentScope Studio backend server to configure more restrictive CORS headers.

What types of attacks can CVE-2024-8489 enable?

CVE-2024-8489 can enable Cross-Site Request Forgery attacks, potentially allowing unauthorized actions on behalf of a user.

Which software is affected by CVE-2024-8489?

CVE-2024-8489 affects the Modelscope AgentScope, specifically the backend server of AgentScope Studio.

What version of Modelscope AgentScope is impacted by CVE-2024-8489?

CVE-2024-8489 impacts the model scope AgentScope's latest commit on the main branch, identified as commit 21161fe.