CVE-2024-1880

Executive Summary

CVE-2024-1880 is a critical OS command injection vulnerability in the MacOSTTS class of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability allows an attacker to execute arbitrary commands on the host system by injecting shell metacharacters into the text-to-speech input when the --speak option is enabled and TEXT_TO_SPEECH_PROVIDER=macos is configured. The root cause is the use of os.system to execute the say command with unsanitized user-supplied text. This vulnerability has a CVSS score of 7.8 (High) and is publicly exploitable. The patch was released in version 5.1.0.

Supply Chain & Package Security

This vulnerability affects the Python package autogpt from the PyPI ecosystem. Users who install AutoGPT via pip are at risk if they use the MacOS TTS feature. The supply chain risk is moderate, as the vulnerability requires local access or a user to be tricked into running a malicious command. However, if AutoGPT is used in a CI/CD pipeline or as a service, the impact could be more severe.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) - The attacker needs local access to the system or must trick a user into running a malicious command.
• Attack Complexity (AC): Low (L) - No special conditions are required; the injection is straightforward.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): Required (R) - The user must run AutoGPT with the --speak option and provide malicious input.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full system compromise possible.
• Integrity (I): High (H) - Arbitrary code execution.
• Availability (A): High (H) - Can disrupt the system.

Threat Level: High (7.8)

Deep Dive & Mechanics

The vulnerability resides in the _speech method of the MacOSTTS class. The method uses os.system to execute the macOS say command with user-supplied text. Since os.system passes the command to a shell, an attacker can inject shell metacharacters (e.g., ;, |, $(...)) to execute arbitrary commands.

Vulnerable Code Path:

1. User runs AutoGPT with --speak and TEXT_TO_SPEECH_PROVIDER=macos.
2. AutoGPT calls MacOSTTS._speech(text) where text is user-controlled.
3. The method executes: os.system(f"say {text}").
4. If text contains ; rm -rf /, the shell executes say ; rm -rf /, leading to command execution.

Attack Scenario: An attacker can craft a malicious input that, when processed by AutoGPT, executes arbitrary commands. For example, if AutoGPT is used to read a file or process user input, the attacker can inject commands.

Vulnerable vs. Patched Code

Vulnerable Code (v0.5.0):

import os

class MacOSTTS:
    def _speech(self, text: str) -> None:
        os.system(f"say {text}")

Patched Code (v5.1.0):

import subprocess
import shlex

class MacOSTTS:
    def _speech(self, text: str) -> None:
        safe_text = shlex.quote(text)
        subprocess.run(["say", safe_text], check=True)

The patch uses subprocess.run with a list of arguments (avoiding shell injection) and shlex.quote to sanitize the input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• AutoGPT v0.5.0 or earlier installed.
• macOS system.
• AutoGPT configured with --speak and TEXT_TO_SPEECH_PROVIDER=macos.

Exploit Steps:

1. Start AutoGPT with the vulnerable configuration.
2. Provide a malicious input that includes shell commands. For example:

   Hello ; echo "pwned" > /tmp/pwned.txt
   

3. The say command will execute, and the shell will also execute echo "pwned" > /tmp/pwned.txt.

Proof-of-Concept (PoC) Script:

import subprocess
import os

# Simulate the vulnerable call
text = "Hello ; echo 'pwned' > /tmp/pwned.txt"
os.system(f"say {text}")

Expected Output:

• The system speaks "Hello".
• A file /tmp/pwned.txt is created with content "pwned".

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unusual say command executions with shell metacharacters.
• Use process monitoring to detect os.system calls with suspicious arguments.

Mitigation:

• Upgrade to AutoGPT v5.1.0 or later.
• If upgrade is not possible, disable the --speak option or use a different TTS provider.
• Implement input validation and sanitization for all user-supplied text.

Indicators of Compromise (IOCs)

• Process: say command executed with arguments containing ;, |, $(, or backticks.
• File: Unexpected files created in /tmp/ or other writable directories.
• Network: Outbound connections from the AutoGPT process to unknown IPs (if the injected command downloads malware).
• Logs: Shell command execution logs showing say with injected commands.

Detection Engineering

YARA Rule

rule CVE_2024_1880_MacOSTTS_Injection {
    meta:
        description = "Detects OS command injection in MacOSTTS class of AutoGPT"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1880"
    strings:
        $vuln_func = "os.system" ascii wide nocase
        $say_cmd = "say" ascii wide nocase
        $inject_chars = /[;&|`$(){}]/
    condition:
        $vuln_func and $say_cmd and #inject_chars > 0
}

Sigma Rule

title: CVE-2024-1880 MacOSTTS Command Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of `say` command with shell metacharacters
author: Valters IT
date: 2024-01-01
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/say'
        CommandLine|contains:
            - ';'
            - '|'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of `say` with special characters (rare)
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-1880 MacOSTTS Command Injection"; content:"say"; content:";"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade AutoGPT to version 5.1.0 or later.
2. If upgrade is not possible, disable the --speak option or set TEXT_TO_SPEECH_PROVIDER to a different provider (e.g., gtts).
3. Implement input validation to reject shell metacharacters.

Long-term Measures:

• Use subprocess.run with argument lists instead of os.system.
• Apply the principle of least privilege to the AutoGPT process.
• Regularly audit dependencies for known vulnerabilities.

Patch Details: The fix was implemented in commit abc123 (hypothetical) and released in version 5.1.0. The patch replaces os.system with subprocess.run and uses shlex.quote for input sanitization.

Valters IT
Securing Digital Frontiers