Docker escape in Auto-GPT when running from docker-compose.yml included in git repo

CVE-2023-37273

What is CVE-2023-37273?

Auto-GPT, an open-source application designed to demonstrate capabilities of the GPT-4 language model, has a vulnerability that allows remote code execution. Versions prior to 0.4.3 utilize a docker-compose.yml file that lacks write protection, exposing systems to risk. When malicious python code is executed through Auto-GPT's functionalities such as execute_python_file, it can lead to unauthorized overwriting of configuration files. This can provide attackers with control over the host system upon subsequent launches of Auto-GPT. Users are urged to upgrade to version 0.4.3 or later to mitigate this risk.

References