Eosphoros Ai
Monthly
DB-GPT through 0.8.2 ships a default docker-compose.yml that hardcodes the MySQL root password and publishes port 3306 on every host interface, so any instance deployed with the stock configuration exposes a root@% database account with publicly known credentials. An unauthenticated remote attacker who can reach port 3306, or who has a foothold on the shared 'dbgptnet' Docker bridge network, can log in with that static password and inherit FILE and SUPER privileges - full read/write access to all DB-GPT data plus the ability to read or write files on the database host. Publicly available exploit code exists (referenced by VulnCheck and Lasso Security); the issue is not in CISA KEV, but any deployment left in its default state is directly exploitable, and operators who rotated the root password, bound 3306 to localhost, or firewalled the host are materially less exposed.
Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
An unrestricted file upload vulnerability exists in eosphoros-ai DB-GPT versions up to 0.7.5 within the module_plugin.refresh_plugins function of the FastAPI endpoint located at packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py. An authenticated attacker can remotely upload arbitrary files to the system, potentially achieving remote code execution or system compromise. A public proof-of-concept exploit is available on GitHub, and the vendor has not responded to early disclosure attempts, indicating patches may not be forthcoming.
SQL injection in eosphoros-ai db-gpt versions up to 0.7.5 allows unauthenticated remote attackers to manipulate the /api/v1/editor/ endpoint and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. This vulnerability impacts confidentiality, integrity, and availability of affected systems.
DB-GPT through 0.8.2 ships a default docker-compose.yml that hardcodes the MySQL root password and publishes port 3306 on every host interface, so any instance deployed with the stock configuration exposes a root@% database account with publicly known credentials. An unauthenticated remote attacker who can reach port 3306, or who has a foothold on the shared 'dbgptnet' Docker bridge network, can log in with that static password and inherit FILE and SUPER privileges - full read/write access to all DB-GPT data plus the ability to read or write files on the database host. Publicly available exploit code exists (referenced by VulnCheck and Lasso Security); the issue is not in CISA KEV, but any deployment left in its default state is directly exploitable, and operators who rotated the root password, bound 3306 to localhost, or firewalled the host are materially less exposed.
Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.
Unauthenticated arbitrary file write in DB-GPT 0.8.0 lets remote attackers achieve remote code execution through the skill_upload endpoint, which builds an upload path by joining the user-controlled multipart filename to the upload directory without canonicalisation or containment checks. Because the route's only auth dependency (get_user_from_headers) returns an admin-role request even when no credentials are supplied, an attacker with no account can write a .py file such as ../../../tmp/x or /tmp/x anywhere the server process can write, then plant or overwrite a Python module that executes when next imported. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the flaw is trivially exploitable and fixed in v0.8.1.
An unrestricted file upload vulnerability exists in eosphoros-ai DB-GPT versions up to 0.7.5 within the module_plugin.refresh_plugins function of the FastAPI endpoint located at packages/dbgpt-serve/src/dbgpt_serve/agent/hub/controller.py. An authenticated attacker can remotely upload arbitrary files to the system, potentially achieving remote code execution or system compromise. A public proof-of-concept exploit is available on GitHub, and the vendor has not responded to early disclosure attempts, indicating patches may not be forthcoming.
SQL injection in eosphoros-ai db-gpt versions up to 0.7.5 allows unauthenticated remote attackers to manipulate the /api/v1/editor/ endpoint and execute arbitrary database queries. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. This vulnerability impacts confidentiality, integrity, and availability of affected systems.