Executive Summary

CVE-2025-32437 is a critical Denial of Service (DoS) vulnerability in the AutoGPT platform affecting versions up to 0.6.62. The vulnerability exists in the MediaDurationBlock component, which downloads and stores video files in a temporary directory but does not delete them after processing. Additionally, the StepThroughItemsBlock can iterate over MediaDurationBlock multiple times without limiting the number of loops. This combination allows a malicious user to cause disk space exhaustion by repeatedly requesting video durations, leading to a DoS condition.

Furthermore, a countdown timer can delay the agent's completion indefinitely, enabling persistent DoS attacks. The issue is related to uncontrolled resource consumption (CWE-400).

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing a Denial of Service (DoS) on the AutoGPT platform. Specifically, a malicious user can exploit the flaw to exhaust disk space by repeatedly triggering video downloads and storage without cleanup. This disk space exhaustion can cause the system to become unresponsive or fail to operate correctly.

Additionally, the vulnerability allows for indefinite delays in agent completion, which can result in persistent service disruption.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring disk space usage on the system where AutoGPT is running, especially in the temporary directories used by MediaDurationBlock. Unusually high or rapidly increasing disk usage may indicate exploitation attempts.

Additionally, monitoring the number of iterations or loops executed by StepThroughItemsBlock could help identify abnormal behavior, as it does not limit the number of loops.

Suggested commands to detect potential exploitation include:

• Use disk usage commands to check for large or growing temporary files, e.g., `du -sh /path/to/temp/dir/*` or `df -h` to monitor overall disk space.
• List recently created or modified files in the temporary directory with `ls -ltr /path/to/temp/dir` to identify accumulation of video files.
• Monitor running AutoGPT processes and their resource consumption using commands like `top` or `ps aux | grep autogpt`.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade AutoGPT to version 0.6.63 or later, where this vulnerability has been patched.

Until the upgrade can be applied, monitor disk space closely and consider implementing manual cleanup of temporary directories used by MediaDurationBlock to prevent disk exhaustion.

Limit or restrict the usage of StepThroughItemsBlock to prevent excessive looping that could lead to resource exhaustion.

Implement monitoring and alerting for unusual disk usage patterns and process behavior related to AutoGPT.

Useful 0 Not Useful 0