CVE-2024-8156: Command Injection in significant-gravitas/autogpt
Description
A command injection vulnerability exists in the workflow-checker.yml workflow of significant-gravitas/autogpt. The untrusted user input `github.head.ref` is used insecurely, allowing an attacker to inject arbitrary commands. This vulnerability affects versions up to and including the latest version. An attacker can exploit this by creating a branch name with a malicious payload and opening a pull request, potentially leading to reverse shell access or theft of sensitive tokens and keys.
Classification
CVE ID: CVE-2024-8156
CVSS Base Severity: HIGH
CVSS Base Score: 8.8
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Problem Types
CWE-94 Improper Control of Generation of CodeAffected Products
Vendor: significant-gravitas
Product: significant-gravitas/autogpt
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.4% (probability of being exploited)
EPSS Percentile: 59.54% (scored less or equal to compared to others)
EPSS Date: 2025-04-18 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-8156https://huntr.com/bounties/959efe87-f109-4cef-94d8-90ff2c7aef51
https://github.com/significant-gravitas/autogpt/commit/1df7d527dd37dff8363dc162fb58d300f072e302