{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:agpt:autogpt_platform:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DE4798F-BA35-4600-8E7E-719C59039D40",
              "versionEndExcluding": "0.6.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python\u0027s requests library, hardening the application against SSRF. The code for this wrapper can be found in autogpt_platform/backend/backend/util/request.py. The requested hostname of a URL which is being requested is validated, ensuring that it does not resolve to any local ipv4 or ipv6 addresses. However, this check is not sufficient, as a DNS server may initially respond with a non-blocked address, with a TTL of 0. This means that the initial resolution would appear as a non-blocked address. In this case, validate_url() will return the url as successful. After validate_url() has successfully returned the url, the url is then passed to the real request() function. When the real request() function is called with the validated url, request() will once again resolve the address of the hostname, because the record will not have been cached (due to TTL 0). This resolution may be in the \"invalid range\". This type of attack is called a \"DNS Rebinding Attack\". This vulnerability is fixed in 0.6.1."
    },
    {
      "lang": "es",
      "value": "AutoGPT es una plataforma que permite a los usuarios crear, implementar y gestionar agentes continuos de inteligencia artificial que automatizan flujos de trabajo complejos. Antes de la versi\u00f3n 0.6.1, AutoGPT permit\u00eda SSRF gracias a la revinculaci\u00f3n de DNS en el contenedor de solicitudes. AutoGPT se basa en un contenedor alrededor de la librer\u00eda de solicitudes de Python, lo que refuerza la aplicaci\u00f3n contra SSRF. El c\u00f3digo de este contenedor se encuentra en autogpt_platform/backend/backend/util/request.py. Se valida el nombre de host de la URL solicitada, lo que garantiza que no se resuelva a ninguna direcci\u00f3n IPv4 o IPv6 local. Sin embargo, esta comprobaci\u00f3n no es suficiente, ya que un servidor DNS podr\u00eda responder inicialmente con una direcci\u00f3n no bloqueada, con un TTL de 0. Esto significa que la resoluci\u00f3n inicial aparecer\u00eda como una direcci\u00f3n no bloqueada. En este caso, validate_url() devolver\u00e1 la URL como correcta. Una vez que validate_url() haya devuelto la URL correctamente, esta se pasa a la funci\u00f3n request() real. Al llamar a la funci\u00f3n request() con la URL validada, request() resolver\u00e1 de nuevo la direcci\u00f3n del nombre de host, ya que el registro no se habr\u00e1 almacenado en cach\u00e9 (debido al TTL 0). Esta resoluci\u00f3n podr\u00eda estar en el rango inv\u00e1lido. Este tipo de ataque se denomina \"Ataque de Revinculaci\u00f3n DNS\". Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.6.1."
    }
  ],
  "id": "CVE-2025-31490",
  "lastModified": "2025-08-05T17:04:28.387",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-04-14T23:15:21.713",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Significant-Gravitas/AutoGPT/commit/66ebe4376eab3434af90808796b54c2139847b37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-wvjg-9879-3m7w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}