| Título | eosphoros-ai DB-GPT 0.8.1 CWE-862 Missing Authorization |
|---|
| Descrição | The conversational (ReAct) agent of DB-GPT v0.8.1 executes tools and actions with no human confirmation because the permission gate is structurally ineffective: review() unconditionally returns (True, None) without inspecting the action or asking the user (packages/dbgpt-core/src/dbgpt/agent/core/base_agent.py:791-793), the review result is only stored in review_info and is never used to block act() (base_agent.py:616-617), and the only approval checkpoint runs after action execution and always passes because approve is always True (base_agent.py:856-857); additionally ActionOutput.ask_user defaults to False (packages/dbgpt-core/src/dbgpt/agent/core/action/base.py:56) and no action in the agent tool-execution path ever sets it True (packages/dbgpt-core/src/dbgpt/agent/core/user_proxy_agent.py:27, 52-53). Combined with default zero authentication — get_user_from_headers() returns role="admin" for any user-id header, or user_id="001"/role="admin" when the header is absent (packages/dbgpt-serve/src/dbgpt_serve/utils/auth.py:25-38), and the ReAct chat endpoint POST /api/v1/chat/react-agent performs no identity check (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py:4373-4377) — an unauthenticated remote attacker can reach the service (default listen x.x.x.x:5670) and frame a task in natural language so that the agent invokes the default-registered code_interpreter tool (agentic_data_api.py:1951-1958) and performs arbitrary actions on the server, such as writing files and modifying configuration. Dynamically verified 2026-08-08 (PoC 5/5): an unauthenticated POST returns HTTP 200 SSE, no confirmation/approval events appear anywhere in the SSE stream, and the agent writes the marker file dbgpt_039_marker.txt (POC_EXECUTED) on the server.
Affected: DB-GPT 0.8.1 (eosphoros-ai/DB-GPT). Patched versions: none (no official fix released as of the reporting date).
Reported to the vendor: https://github.com/eosphoros-ai/DB-GPT/issues/3289 (public issue filed 2026-10-14). Reported to CNVD: CNVD-2026-37345 (accepted 2026-09-17, severity high). |
|---|
| Fonte | ⚠️ https://github.com/ybyu-ieu/agent-security-advisories/blob/main/dbgpt/dbgpt-react-agent-tool-execution-missing-permission-gate.md |
|---|
| Utilizador | Ybyu (UID 101038) |
|---|
| Submissão | 14/10/2026 10h21 (há 22 dias) |
|---|
| Moderação | 05/11/2026 07h14 (22 days later) |
|---|
| Estado | Duplicado |
|---|
| Entrada VulDB | 422583 [eosphoros-ai DB-GPT até 0.8.2 ReAct Agent /api/v1/chat/react-agent get_user_from_headers Elevação de Privilégios] |
|---|
| Pontos | 0 |
|---|