PT-2025-12076 · Uvicorn+1 · Uvicorn+1

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10906

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version 0.6.0

Description The issue arises from an overly permissive instance of CORSMiddleware in the uvicorn app created by dbgpt server, which sets the Access-Control-Allow-Origin to * for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF). An attacker can exploit this to interact with any endpoints of the instance, even if the instance is not publicly exposed to the network.

Recommendations For version 0.6.0, consider restricting the Access-Control-Allow-Origin header to only allow requests from trusted origins as a temporary workaround. Restrict access to sensitive endpoints to minimize the risk of exploitation. Avoid using the overly permissive CORSMiddleware instance until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-10906

GHSA-3248-F932-C76P

Affected Products

Eosphoros-Ai/Db-Gpt

Uvicorn

References · 7

• 🔥 https://huntr.com/bounties/8864aca5-a342-4dab-b866-b2882ba6f160 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-10906 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10906 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3248-f932-c76p · Vendor Advisory
• https://github.com/eosphoros-ai/DB-GPT · Note
• https://github.com/eosphoros-ai/DB-GPT/blob/f5de05b2636bc0628b3a92d32b22a26f88a18f2a/dbgpt/app/dbgpt_server.py#L240 · Note
• https://twitter.com/CVEnew/status/1902968842147799234 · Twitter Post