Medium severity · published Mar 20, 2025
CVE-2024-10457
SSRF Vulnerabilities in significant-gravitas/autogpt
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integration and Web Search blocks. These vulnerabilities affect version agpt-platform-beta-v0.1.1. The issues arise when block inputs are controlled by untrusted sources, leading to potential credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include GithubListPullRequestsBlock, GithubReadPullRequestBlock, GithubAssignPRReviewerBlock, GithubListPRReviewersBlock, GithubUnassignPRReviewerBlock, GithubCommentBlock, GithubMakeIssueBlock, GithubReadIssueBlock, GithubListIssuesBlock, GithubAddLabelBlock, GithubRemoveLabelBlock, GithubListBranchesBlock, and ExtractWebsiteContentBlock.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
significant-gravitas/autogpt · significant-gravitas
before autogpt-platform-beta-v0.2.1 · source: vendor
Affected product
SI
significant-gravitas/autogpt
significant-gravitas
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10457
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10457
github.com
https://github.com/significant-gravitas/autogpt/commit/bcaf3241dadfc1fca024e91fb8f2e3004105a172
huntr.com
https://huntr.com/bounties/1d91e1e1-7d45-4bda-bc27-bfe9052fd975
More from significant-gravitas/autogpt
9.8
CVE-2024-8156
Command Injection in significant-gravitas/autogpt
9.8
CVE-2024-6091
Shell Command Denylist Bypass in significant-gravitas/autogpt
9.8
CVE-2024-1881
Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt
8.8
CVE-2025-1040
Server-Side Template Injection (SSTI) in significant-gravitas/autogpt
8.8
CVE-2024-1879
CSRF to RCE in significant-gravitas/autogpt