Unauthenticated Remote Code Execution in DB-GPT

Executive Summary

DB-GPT through 0.8.2 has an unauthenticated remote code execution (RCE) vulnerability in the /api/v1/chat/react-agent endpoint. The flaw stems from a mock authentication function that automatically grants admin privileges to all users. Attackers can exploit this by sending malicious prompts that trigger unsandboxed code_interpreter and shell_interpreter tools, allowing arbitrary Python or bash command execution as root in the webserver container.

Useful 0 Not Useful 0

Detection Guidance

Check if DB-GPT version 0.8.2 or earlier is installed by running: pip show db-gpt or checking package versions. Inspect network traffic for requests to /api/v1/chat/react-agent endpoints. Monitor for unexpected root-level command execution or Python code execution logs in the DB-GPT container or server logs.

• Use curl to test the vulnerable endpoint: curl -X POST http://<target>/api/v1/chat/react-agent -H 'Content-Type: application/json' -d '{"prompt":"malicious command"}' to see if arbitrary code executes.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can execute arbitrary code as root on the server hosting DB-GPT, potentially taking full control of the system. This includes accessing the bundled database with default credentials, stealing sensitive data, installing malware, or disrupting services. The vulnerability affects all versions up to and including 0.8.2.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data. GDPR mandates strict data protection and breach notification, while HIPAA requires safeguards for protected health information. A successful exploit could lead to unauthorized data exposure, triggering regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DB-GPT to a version that patches this vulnerability immediately. If upgrading is not possible, disable the /api/v1/chat/react-agent endpoint or restrict access to trusted networks. Remove or patch the mock get_user_from_headers function to enforce proper authentication.

• Apply network-level controls to block unauthorized access to the vulnerable API endpoint until a patch is applied.

Useful 0 Not Useful 0