p PatchFirst

CVE-2024-6091

CVE-2024-6091 · Shell Command Denylist Bypass in significant-gravitas/autogpt

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.

CVSS 9.8 · Crítica · EPSS 0,8% · Corrección disponible

Publicación
Actualización

Pila tecnológica: python

Productos y versiones afectados

  • significant-gravitas/autogpt

    Versiones
    • ≥ unspecified, < 0.5.1: Afectada (custom)

    Actualiza a 0.5.1

  • agpt PyPI

    Versiones
    • 0.2.2
    Intervalos de versiones afectados
    • ECOSYSTEM: ≤ 0.5.1

    Sin corrección publicada

Fuentes originales

Comprueba tu servidor →