AutoGPT allows SSRF due to DNS Rebinding in requests wrapper

The SSRF vulnerability in AutoGPT arises from inadequate validation of hostnames within the requests wrapper. While the code attempts to prevent SSRF by blocking requests to local IPv4 and IPv6 addresses, this check is insufficient to prevent DNS rebinding attacks. An attacker could exploit this by manipulating DNS records to resolve a hostname to an internal IP address, effectively bypassing the intended security measure. This could lead to unauthorized access to internal APIs, databases, or other sensitive resources within the AutoGPT environment. The potential blast radius depends on the internal services accessible from the AutoGPT server.

Organizations and individuals deploying AutoGPT for automation tasks are at risk. Specifically, those running AutoGPT in environments with sensitive internal resources or services are particularly vulnerable. Shared hosting environments where AutoGPT is deployed alongside other applications may also be at increased risk.

• python / server:

import socket
import requests

def check_dns_rebinding(hostname):
    try:
        ip_address = socket.gethostbyname(hostname)
        # Add checks for internal IP ranges here
        if ip_address.startswith('127.0.0.') or ip_address.startswith('192.168.') or ip_address.startswith('10.0.'): #Example internal ranges
            return True
        return False
    except socket.gaierror:
        return False

# Example usage (replace with actual AutoGPT request logic)
url = 'http://example.com'
if check_dns_rebinding(url):
    print(f"Potential DNS rebinding detected for {url}")

• generic web:

curl -v 'http://autogpt-server/api/some-endpoint' 2>&1 | grep -i 'resolving to:'

1. 2025-04-14Disclosure

   disclosure

1. 予約済み2025-03-28
2. 公開日2025-04-14
3. 更新日2025-04-15
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-31490 is to upgrade AutoGPT to version 0.6.1 or later, which includes the necessary hostname validation improvements. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block requests to suspicious or internal IP addresses. Additionally, review and restrict network access to the AutoGPT server, limiting its ability to make outbound requests to untrusted hosts. Regularly monitor AutoGPT logs for unusual outbound connections or DNS resolution patterns.