Summary AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin.

Details

AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python plugin that will be imported here, enabling arbitrary command execution on the target host.

Impact

All publicly accessible AstrBot instances are vulnerable.

For more information, please see: CVE-2025-55449-AstrBot-RCE

Patch

This vulnerability was first reported on 2025-06-21 and was patched on the same day (2025-06-21).

The vulnerability was publicly disclosed on 2025-11-14. Prior to public disclosure, monitoring from AstrBot Cloud indicated that fewer than 2% of deployed instances were still running the affected version. Therefore, this disclosure is not expected to have a significant impact on existing active instances.

AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function installpluginupload of the interface '/plugin/install-upload' parses the filename from the request body provided by the user, and directly uses the filename to assign to filepath without checking the validity of the filename. The variable filepath is then passed as a parameter to the function file.save, so that the file in the request body can be saved to any location in the file system through directory traversal.

AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function encodeimagebs64. Since the encodeimagebs64 function defined in entities.py opens the image specified by the user in the request body and returns the image content as a base64-encoded string without checking the legitimacy of the image path, attackers can construct a series of malicious URLs to read any specified file, resulting in sensitive data leakage.

Impact

This vulnerability may lead to:

Information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data.

Reproduce

Follow these steps to set up a test environment for reproducing the vulnerability:

1. Install dependencies and clone the repository:

bash pip install uv git clone https://github.com/AstrBotDevs/AstrBot && cd AstrBot uv run main.py

2. Alternatively, deploy the program via pip:

bash mkdir astrbot && cd astrbot uvx astrbot init uvx astrbot run

3. In another terminal, run the following command to exploit the vulnerability:

bash curl -L http://0.0.0.0:6185/api/chat/getfile?filename=../../../data/cmdconfig.json

This request will read the cmdconfig.json config file, leading to the leakage of sensitive data such as LLM API keys, usernames, and password hashes (MD5).

Patches

The vulnerability has been addressed in Pull Request #1676 and is included in versions >= v3.5.13. All users are strongly encouraged to upgrade to v3.5.13 or later.

Workarounds Users can edit the cmdconfig.json file to disable the dashboard feature as a temporary workaround. However, it is strongly recommended to upgrade to version v3.5.13 or later as soon as possible to fully resolve this issue.

References

Pull Request #1676 Issue #1675