Executive brief
DB-GPT is an open-source AI data assistant that exposes a web API via a uvicorn application server. The vulnerability allows attackers to forge requests to any endpoint of the application without the victim's knowledge through a compromised web page, potentially enabling unauthorized actions like data exfiltration, modification, or service disruption even on instances that appear isolated from public networks.
Technical details
The vulnerability is a Cross-Site Request Forgery (CSRF) caused by overly permissive CORSMiddleware configuration in the uvicorn application, which sets Access-Control-Allow-Origin to * for all requests. This allows any web page to make authenticated cross-origin requests to the DB-GPT API endpoints. An attacker can craft a malicious webpage that, when visited by a user with access to the DB-GPT instance, automatically executes API calls on behalf of the victim. The vulnerable versions are 0.6.0 and all versions in the 0.* series up to 0.5.10; patched versions should restrict CORS origins to trusted domains only. No precondition such as network exposure is required—even internal instances are vulnerable if accessed by a user who visits a malicious site.
Affected products
- eosphoros-ai DB-GPT 0.x through 0.6.0
Timeline
- 2025-03-20: disclosed
- 2025-03-20: advisory