CVE-2024-23750
📋 TL;DR
CVE-2024-23750 is a critical code injection vulnerability in MetaGPT that allows attackers with QaEngineer role access to execute arbitrary commands on the host system. This occurs because the RunCode.run_script() function improperly passes user-controlled input containing shell metacharacters to subprocess.Popen without proper sanitization. All MetaGPT deployments with QaEngineer role functionality are affected.
💻 Affected Systems
- MetaGPT
📦 What is this software?
Metagpt by Deepwisdom
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands with the privileges of the MetaGPT process, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Unauthorized code execution leading to data exfiltration, installation of backdoors, or disruption of MetaGPT functionality.
If Mitigated
Limited impact if proper input validation and role-based access controls are implemented, restricting QaEngineer role access to trusted users only.
🎯 Exploit Status
Exploitation requires QaEngineer role access but is trivial once obtained. Public GitHub issue demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.6.5 or later
Vendor Advisory: https://github.com/geekan/MetaGPT/issues/731
Restart Required: Yes
Instructions:
1. Update MetaGPT to version 0.6.5 or later using pip: pip install --upgrade metagpt
2. Restart all MetaGPT services and processes
3. Verify the update was successful
🔧 Temporary Workarounds
Input Sanitization
allImplement input validation to reject shell metacharacters in RunCode.run_script() inputs
Modify RunCode.run_script() to sanitize inputs before passing to subprocess.Popen
Role Restriction
allTemporarily disable or restrict QaEngineer role access until patching
Modify role configuration to remove QaEngineer permissions from untrusted users
🧯 If You Can't Patch
- Implement strict network segmentation to isolate MetaGPT instances from critical systems
- Enforce least privilege access controls and audit all QaEngineer role assignments
🔍 How to Verify
Check if Vulnerable:
Check MetaGPT version: if version <= 0.6.4, system is vulnerableCheck Version:
python -c "import metagpt; print(metagpt.__version__)"Verify Fix Applied:
Verify MetaGPT version is 0.6.5 or later and test that shell metacharacters in RunCode.run_script() inputs are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual subprocess.Popen executions from MetaGPT
- Shell metacharacters in MetaGPT input logs
- Unexpected process spawns from MetaGPT service
Network Indicators:
- Outbound connections from MetaGPT to unexpected destinations
- Command and control traffic patterns
SIEM Query:
process_name:"python" AND parent_process_name:"metagpt" AND cmdline:("sh" OR "bash" OR "cmd")