Description
DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role. Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container, including reaching the bundled database with default credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| eosphoros-ai | DB-GPT | ≤ 0.8.2 | — |
References
- Lasso.security Advisory technical-description exploit
- https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/packages/dbgpt-serve/src/dbgpt_serve/utils/auth.py#L25 technical-description
- https://github.com/eosphoros-ai/DB-GPT/blob/83609c471266607490b24e72188311efa23a0d16/packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/tools/code_interpreter.py#L39 technical-description
- VulnCheck Advisory: DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent third-party-advisory