PT-2024-20056 · Metagpt · Metagpt

Fubuki8087 · Published 2024-01-21 · Updated 2024-01-29 · CVE-2024-23750

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MetaGPT versions 0.6.4 and earlier

Description The issue allows the QaEngineer role to execute arbitrary code because RunCode.run script() passes shell metacharacters to subprocess.Popen. This enables potential exploitation, but specific details about the number of affected devices or real-world incidents are not provided.

Recommendations For MetaGPT versions 0.6.4 and earlier, as a temporary workaround, consider restricting the QaEngineer role's access to the RunCode.run script() function until a patch is available. Additionally, avoid passing user-controlled input to subprocess.Popen to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-23750

GHSA-G7PH-8423-PF4J

PYSEC-2024-9

Affected Products

Metagpt

References · 10

• 🔥 https://github.com/geekan/MetaGPT/issues/731 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-23750 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23750 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g7ph-8423-pf4j · Vendor Advisory
• https://github.com/geekan/MetaGPT · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/metagpt/PYSEC-2024-9.yaml · Note
• https://t.me/cvenotify/69105 · Telegram Post
• https://twitter.com/CVEnew/status/1749253633701777460 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1749318644004221193 · Twitter Post