AutoGPT Server Vulnerable to CSRF Attacks

CVE-2024-1879

Summary

A security vulnerability exists in AutoGPT version v0.5.0 due to insufficient protection on the API endpoint that processes instructions. This flaw allows attackers to leverage Cross-Site Request Forgery techniques, guiding users running AutoGPT in local networks to malicious sites. These sites can send forged requests to the AutoGPT server, potentially leading to command execution. The risk is heightened by the default configuration of CORS, which permits arbitrary origins, enabling attackers to access responses from cross-site requests. Version 5.1 resolves this vulnerability, reinforcing security measures against such exploit attempts.

References