PT-2023-25876 · Autogpt · Autogpt

Lukas-Eu + 1 · Publicado 2023-07-13 · Atualizado 2026-02-24 · CVE-2023-37273

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Auto-GPT versions prior to 0.4.3

Description The issue arises from the use of a different docker-compose.yml file when running Auto-GPT by cloning the git repo and executing docker compose run auto-gpt in the repo root. This file mounts itself into the docker container without write protection, allowing malicious custom python code executed via the execute python file and execute python code commands to overwrite the docker-compose.yml file. This can lead to abuse and gain control of the host system the next time Auto-GPT is started.

Recommendations For versions prior to 0.4.3, update to version 0.4.3 to resolve the issue. As a temporary workaround, consider disabling the execute python file and execute python code commands until the update is applied. Restrict access to the docker-compose.yml file to minimize the risk of exploitation.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-37273

GHSA-X5GJ-2CHR-4CH6

Produtos afetados

Autogpt

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37273.json · Exploit
• https://github.com/Significant-Gravitas/Auto-GPT/pull/4761 · Correção
• https://github.com/Significant-Gravitas/Auto-GPT/security/advisories/GHSA-x5gj-2chr-4ch6 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-37273 · Nota de Segurança
• https://t.me/cveNotify/153044 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37273 · Aviso do Fabricante