Cross-Site Request Forgery Vulnerability in AgentScope Studio by Modelscope

CVE-2024-8489

What is CVE-2024-8489?

A Cross-Site Request Forgery vulnerability has been identified in the backend of Modelscope's AgentScope Studio. This vulnerability arises from overly permissive Cross-Origin Resource Sharing (CORS) headers, allowing unauthorized access to sensitive backend endpoints. An attacker can exploit this flaw to execute requests against the backend, such as the api/file endpoint, potentially reading arbitrary files from the target's local file system. This situation poses significant risks to user privacy and data integrity, making immediate remediation critical.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References