DB-GPT Pfadüberschreitungs-Schwachstelle

The impact of this vulnerability is significant, as it grants an attacker the ability to delete arbitrary files on the server hosting the db-gpt application. This could lead to data loss, disruption of service, and potentially even complete compromise of the system. An attacker could delete critical configuration files, application code, or sensitive data stored on the server. The blast radius extends to any data accessible by the db-gpt application, and the ease of exploitation makes it a high-priority concern. While no direct precedent is immediately obvious, the potential for widespread data deletion mirrors the impact of other path traversal vulnerabilities where attackers gain unauthorized file system access.

Organizations deploying db-gpt in production environments, particularly those handling sensitive data or integrating with other critical systems, are at risk. Shared hosting environments where db-gpt instances share resources are also vulnerable, as an attacker could potentially exploit this vulnerability to impact other tenants.

• python / server:

# Monitor for requests to /v1/resource/file/delete with suspicious file_key parameters
# Example: grep '..' /var/log/nginx/access.log | grep '/v1/resource/file/delete'

• generic web:

# Check for the existence of the endpoint
curl -I https://your-dbgpt-instance/v1/resource/file/delete

1. 2025-03-20Disclosure

   disclosure

1. Reserviert2024-11-04
2. Veröffentlicht2025-03-20
3. Geändert2025-03-21
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-10830 is to upgrade to a patched version of eosphoros-ai/db-gpt. The vendor has not released a specific fixed version as of this writing, so monitor their repository for updates. As a temporary workaround, implement strict input validation on the filekey parameter, ensuring it only accepts expected values. Consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters or patterns in the filekey parameter. Regularly review file system permissions to limit the application's access to only necessary files.