AutoGPT vulnerabilities

AutoGPT, a workflow automation platform, has an XSS vulnerability in versions prior to 0.6.62 on the signup page. The application improperly trusts a URL parameter (`next`), allowing an attacker to execute malicious JavaScript in the victim's browser.

AutoGPT before 0.6.70 has a vulnerability in the webhook_ingress_generic route that does not verify the webhook provider, allowing bypass of signature verification and execution of a generic webhook as its owner.

In AutoGPT prior to version 0.6.32, there is a DoS vulnerability in the ExtractTextInformationBlock. A malicious user can send 10 KB of content, causing the server to consume 50 GB of memory, leading to resource exhaustion and denial of service.

AutoGPT prior to version 0.6.63 has an issue with disk space management as `MediaDurationBlock` downloads and stores video in a temporary directory without deleting it after processing. `StepThroughItemsBlock` allows for multiple iterations of `MediaDurationBlock`, which can lead to disk space exhaustion.

AutoGPT prior to version 0.6.63 has an issue with disk space management as it does not delete video and audio files from the temporary directory. Additionally, the `StepThroughItemsBlock` does not limit the number of iterations, which can lead to disk space exhaustion.

AutoGPT is a workflow automation platform that prior to version 0.6.63 had an issue with the ScreenshotWebPageBlock storing screenshots in a temporary directory. The StepThroughItemsBlock did not limit the number of iterations, which could lead to disk space exhaustion and a DoS attack.

In AutoGPT prior to version 0.6.59, the POST /api/blocks/{block_id}/execute endpoint executes blocks without consuming any credits, regardless of the user's balance. The credit check in the graph execution path (manager.py) is never reached when blocks are called directly via the external API, allowing unlimited free execution of all blocks.

In AutoGPT (versions 0.1.0 through 0.6.51), the SendEmailBlock accepts user-supplied smtp_server and smtp_port parameters and passes them directly to smtplib.SMTP() without IP address validation, bypassing SSRF protections. An authenticated user can perform internal network port scanning and service fingerprinting.

AutoGPT versions 0.6.34 through 0.6.51 deserialize Redis cache bytes using pickle.loads without integrity checks. An attacker who poisons a Redis key can achieve remote code execution in the backend container.

AutoGPT versions 0.4.2 through 0.6.51 are vulnerable to a DoS attack via the download_agent_file endpoint, which creates persistent temporary files for each request but fails to delete them. An unauthenticated attacker can repeatedly call this endpoint to exhaust disk space and cause system failure.

AutoGPT versions 0.6.36 through 0.6.50 are vulnerable to authenticated session hijacking via IDOR. An attacker can take over another user's session by knowing their session_id.

In AutoGPT before version 0.6.32, there is no limit on container log size, which can lead to disk resource exhaustion and DoS when user access is high. The issue is fixed in autogpt-platform-beta-v0.6.32.