CVE-2024-10457

Executive Summary

CVE-2024-10457 identifies multiple Server-Side Request Forgery (SSRF) vulnerabilities in the AutoGPT platform, specifically in the significant-gravitas/autogpt repository, version agpt-platform-beta-v0.1.1. The vulnerabilities affect the GitHub Integration and Web Search blocks, allowing an attacker to control block inputs from untrusted sources. This can lead to credential leakage, internal network scanning, and unauthorized access to internal services, APIs, or data stores. The affected blocks include a wide range of GitHub operations and web content extraction. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation probability at this time.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the AutoGPT platform, which is a Python-based application. The risk lies in the platform's integration with external services (GitHub API, web scraping) where untrusted input can trigger SSRF. Organizations using AutoGPT should review their deployment configurations and ensure that the platform is not exposed to untrusted network sources.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is considered Medium due to the potential for internal network reconnaissance and credential leakage, but the lack of public exploits and low EPSS score reduces immediate risk.

Deep Dive & Mechanics

The SSRF vulnerabilities arise from the AutoGPT platform's GitHub Integration and Web Search blocks. These blocks accept user-controlled inputs (e.g., repository URLs, pull request IDs, issue numbers) and make HTTP requests to external services. When an attacker provides a malicious input, such as a URL pointing to an internal service (e.g., http://169.254.169.254/ for cloud metadata), the platform will make a request to that internal endpoint, potentially leaking sensitive information.

The affected blocks include:

• GithubListPullRequestsBlock
• GithubReadPullRequestBlock
• GithubAssignPRReviewerBlock
• GithubListPRReviewersBlock
• GithubUnassignPRReviewerBlock
• GithubCommentBlock
• GithubMakeIssueBlock
• GithubReadIssueBlock
• GithubListIssuesBlock
• GithubAddLabelBlock
• GithubRemoveLabelBlock
• GithubListBranchesBlock
• ExtractWebsiteContentBlock

The root cause is insufficient validation of user-supplied URLs or identifiers before making HTTP requests. The platform does not restrict the target IP addresses or domains, allowing requests to internal networks.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation in version agpt-platform-beta-v0.1.1. The code likely uses a generic HTTP client (e.g., requests library in Python) without proper URL validation or allowlisting.

Vulnerable Code Example (Conceptual):

import requests

def fetch_github_data(url):
    response = requests.get(url)
    return response.text

Patched Code Example (Conceptual):

import requests
from urllib.parse import urlparse

ALLOWED_DOMAINS = ["api.github.com", "github.com"]

def fetch_github_data(url):
    parsed = urlparse(url)
    if parsed.hostname not in ALLOWED_DOMAINS:
        raise ValueError("Domain not allowed")
    response = requests.get(url)
    return response.text

The patch should include:

• URL validation against an allowlist of trusted domains.
• Blocking requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
• Input sanitization to prevent injection of arbitrary URLs.

Exploitation & Lab Setup

Red Team

Objective: Exploit SSRF to access internal services or leak credentials.

Lab Setup:

1. Deploy AutoGPT platform version agpt-platform-beta-v0.1.1 in a controlled environment.
2. Set up a simple internal HTTP server (e.g., using Python's http.server) on a private IP (e.g., 192.168.1.100:8080) to simulate an internal service.
3. Use the ExtractWebsiteContentBlock or any GitHub block to trigger SSRF.

Exploitation Steps:

1. Access the AutoGPT platform interface.
2. In the ExtractWebsiteContentBlock, provide a URL pointing to an internal service, e.g., http://192.168.1.100:8080/.
3. Observe that the platform fetches the content from the internal server, confirming SSRF.
4. For credential leakage, target cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/ on AWS).

Expected Output: The internal server logs show a request from the AutoGPT platform, and the response is returned to the attacker.

Blue Team

Objective: Detect and prevent SSRF exploitation.

Detection Steps:

1. Monitor outbound HTTP requests from the AutoGPT platform for unusual destinations (e.g., private IP ranges, cloud metadata endpoints).
2. Implement network segmentation to restrict the platform's outbound access to only necessary external services (e.g., GitHub API).
3. Use a web application firewall (WAF) to block requests to private IP addresses.

Mitigation Steps:

1. Apply input validation and allowlisting as described in the patched code section.
2. Disable or restrict the use of blocks that accept arbitrary URLs if not needed.
3. Update to a patched version once available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
  • Requests to cloud metadata endpoints (e.g., http://169.254.169.254/).
  • Unusual User-Agent strings (e.g., python-requests/2.x).

• File IOCs:

  • Logs containing URLs with private IP addresses.
  • Configuration files with modified block inputs.

• Behavioral IOCs:

  • Unexpected access to internal services from the AutoGPT platform.
  • Repeated failed attempts to access restricted URLs.

Detection Engineering

YARA Rule

rule Detect_SSRF_AutoGPT {
    meta:
        description = "Detects SSRF attempts in AutoGPT platform logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10457"
    strings:
        $url_pattern = /https?:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $metadata_endpoint = "169.254.169.254"
    condition:
        any of them
}

Sigma Rule

title: SSRF Attempt via AutoGPT Platform
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects outbound HTTP requests from AutoGPT to private IP ranges or cloud metadata endpoints.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-10457
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationIp:
            - '10.*'
            - '172.16.*'
            - '172.17.*'
            - '172.18.*'
            - '172.19.*'
            - '172.20.*'
            - '172.21.*'
            - '172.22.*'
            - '172.23.*'
            - '172.24.*'
            - '172.25.*'
            - '172.26.*'
            - '172.27.*'
            - '172.28.*'
            - '172.29.*'
            - '172.30.*'
            - '172.31.*'
            - '192.168.*'
            - '127.*'
            - '169.254.*'
        Image: '*autogpt*'
    condition: selection
falsepositives:
    - Legitimate internal network monitoring tools
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10457 SSRF Attempt via AutoGPT"; flow:to_server; content:"GET"; http_method; content:"Host"; http_header; pcre:"/Host:\s*(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict outbound network access from the AutoGPT platform to only necessary external services (e.g., GitHub API).
   • Implement a web application firewall (WAF) to block requests to private IP ranges.
   • Monitor logs for SSRF indicators.

2. Long-term Fixes:

   • Apply input validation and allowlisting for all URLs used in blocks.
   • Block requests to private IP ranges and cloud metadata endpoints at the application level.
   • Update to a patched version once available from the vendor.

3. Workarounds:

   • Disable the affected blocks if not required.
   • Use a reverse proxy to filter outbound requests.

Valters IT