eosphoros-ai/db-gpt · Security
DB-GPT vulnerable to Cross-Site Request Forgery
- GHSA ID
- GHSA-3248-f932-c76p
- CVE ID
- CVE-2024-10906
- Severity
- high
- Published
- Updated
- CVSS
- 7.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
- CVSS v3
- 7.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Description
In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgpt_server uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to * for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this vulnerability to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.
CWEs
- CWE-352 · Cross-Site Request Forgery (CSRF)