| タイトル | eosphoros-ai DB-GPT 0.8.1 CWE-94 Improper Control of Generation of Code ('Code Injection') |
|---|
| 説明 | DB-GPT v0.8.1 (eosphoros-ai/DB-GPT) executes LLM-generated code blocks natively in the server process context — no sandbox, no command allowlist, no human confirmation — giving unauthenticated remote code execution. The CodeEngineer agent (CodeAssistantAgent) registers CodeAction as its default action (code_assistant_agent.py:118-121); CodeAction regex-extracts code blocks from the LLM output (code_action.py:40) and runs every python/bash/shell block through execute_code() (code_action.py:59, 98-105). Inside execute_code() (code_utils.py:255-287), os.path.exists('/.dockerenv') makes `if not use_docker or in_docker_container` always true inside the official Docker container (OR short-circuit), so the code is run natively via subprocess.run([sys.executable, <temp script>]) — the product's own Docker sandbox path (code_utils.py:302-341) is silently bypassed even when the Docker SDK is installed. The permission review is a no-op (base_agent.py:791-793, review() unconditionally returns True). The default deployment adds zero authentication: auth.py:25-38 mock authentication always returns role='admin', api_v2.py:43-68 lets requests through when api_keys is empty (the default), and the service listens on x.x.x.x:5670. An attacker with network access creates a single-agent app using CodeEngineer via an unauthenticated POST /api/v1/app/create, then induces the LLM to emit a code block via an unauthenticated POST /api/v1/chat/completions; the code executes natively in the container (server log "EXECUTING CODE BLOCK 0", no sandbox container created), allowing arbitrary commands — reading environment variables including the LLM API key, mounted volumes and internal databases, and lateral movement. Dynamically verified 8/8 in the official Docker deployment (2026-08-23).
Affected: DB-GPT 0.8.1 — official Docker containerized deployment (default trigger) and bare-metal with Docker SDK missing/disabled. Patched versions: none (no official fix released as of the CNVD submission date).
Reported to the vendor: https://github.com/eosphoros-ai/DB-GPT/issues/3287 (public issue filed 2026-10-14); otherwise reported via CNVD only (accepted as CNVD-2026-37603 on 2026-09-18); GHSA not used. |
|---|
| ソース | ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-codeaction-native-subprocess-llm-code-execution.md |
|---|
| ユーザー | Ybyu (UID 101038) |
|---|
| 送信 | 2026年10月14日 10:19 (22 日 ago) |
|---|
| モデレーション | 2026年11月05日 07:18 (22 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 431392 [eosphoros-ai DB-GPT 迄 0.8.2 CodeAction code_utils.py execute_code 特権昇格] |
|---|
| ポイント | 20 |
|---|