Command Injection Vulnerability in Autogpt by Significant Gravitas
CVE-2024-8156
9.8CRITICAL
What is CVE-2024-8156?
A command injection vulnerability arises in the workflow-checker.yml file of Autogpt by Significant Gravitas. This issue stems from improper handling of user input from github.head.ref, which can be exploited by an attacker. By crafting a branch name containing malicious code and opening a pull request, an attacker could potentially execute arbitrary commands on the server. This vulnerability could lead to serious consequences, including unauthorized reverse shell access or the compromise of sensitive information, such as tokens and keys.
Affected Version(s)
significant-gravitas/autogpt < 0.5.1
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
CVSS V3.0
Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved