Significant-Gravitas AutoGPT up to 0.6.0 IPv6 Address request.py validate_url server-side request forgery

Summaryinfo

A vulnerability was found in Significant-Gravitas AutoGPT up to 0.6.0. It has been rated as critical. This affects the function validate_url of the file autogpt_platform/backend/backend/util/request.py of the component IPv6 Address Handler. This manipulation causes server-side request forgery. This vulnerability is registered as CVE-2025-31490. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Significant-Gravitas AutoGPT up to 0.6.0. It has been declared as critical. Affected by this vulnerability is the function validate_url of the file autogpt_platform/backend/backend/util/request.py of the component IPv6 Address Handler. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality. The summary by CVE is:

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python's requests library, hardening the application against SSRF. The code for this wrapper can be found in autogpt_platform/backend/backend/util/request.py. The requested hostname of a URL which is being requested is validated, ensuring that it does not resolve to any local ipv4 or ipv6 addresses. However, this check is not sufficient, as a DNS server may initially respond with a non-blocked address, with a TTL of 0. This means that the initial resolution would appear as a non-blocked address. In this case, validate_url() will return the url as successful. After validate_url() has successfully returned the url, the url is then passed to the real request() function. When the real request() function is called with the validated url, request() will once again resolve the address of the hostname, because the record will not have been cached (due to TTL 0). This resolution may be in the "invalid range". This type of attack is called a "DNS Rebinding Attack". This vulnerability is fixed in 0.6.1.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-31490 since 03/28/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 0.6.1 eliminates this vulnerability. Applying the patch 66ebe4376eab3434af90808796b54c2139847b37 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Significant-Gravitas

Name

• AutoGPT

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6.0

License

• open-source

Website

• Product: https://github.com/Significant-Gravitas/AutoGPT/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion