Requests ユーティリティにおける SSRF チェック バイパス (SSRF Check Bypass) in significant-gravitas/autogpt

The SSRF vulnerability in significant-gravitas/autogpt allows a malicious user to craft a specially designed URL, such as http://localhost:\@google.com/../, to bypass the intended SSRF protection. Successful exploitation enables an attacker to make requests to internal resources that are otherwise inaccessible from the outside. This could include accessing sensitive data stored on internal servers, interacting with internal APIs, or even potentially gaining access to cloud metadata services. The blast radius extends to any internal service reachable from the autogpt instance, posing a significant risk to the confidentiality and integrity of the system.

Organizations using significant-gravitas/autogpt in environments with internal services or cloud metadata exposure are at risk. Specifically, deployments where autogpt is granted broad network access or interacts with sensitive internal APIs are particularly vulnerable. Shared hosting environments utilizing autogpt also pose a risk, as a compromised autogpt instance could potentially be used to attack other tenants on the same server.

• python / server:

import re

def check_request_url(url):
    if re.search(r'localhost:\@', url):
        return True
    return False

# Example usage
url = input("Enter the URL: ")
if check_request_url(url):
    print("Potential SSRF vulnerability detected!")
else:
    print("URL appears safe.")

• linux / server: journalctl filters for requests to unusual hostnames (e.g., journalctl | grep 'localhost:\@'). • generic web: Check access logs for requests containing localhost:\@ or similar hostname manipulation patterns.

1. 2025-03-20Disclosure

   disclosure

1. 予約済み2025-01-13
2. 公開日2025-03-20
3. EPSS 更新日2026-04-02

The primary mitigation for CVE-2025-0454 is to upgrade significant-gravitas/autogpt to version v0.4.0 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter out potentially malicious URLs containing hostname manipulation techniques like double colon escapes. Additionally, review and restrict the allowed URL schemes and domains that autogpt is permitted to access. Monitor network traffic for unusual outbound requests originating from the autogpt instance.