CVE-2025-22603
📋 TL;DR
AutoGPT versions prior to beta-v0.4.2 contain a server-side request forgery (SSRF) vulnerability in the 'Send Web Request' component that fails to filter IPv6 addresses. This allows attackers to make unauthorized requests from the AutoGPT server to internal IPv6 services. Users running vulnerable AutoGPT instances are affected.
💻 Affected Systems
- AutoGPT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal IPv6 services, exfiltrate data, or pivot to attack other internal systems through the AutoGPT server.
Likely Case
Unauthorized access to internal IPv6 services, potentially exposing internal APIs, databases, or management interfaces.
If Mitigated
Limited impact if network segmentation restricts AutoGPT server's access to sensitive internal services.
🎯 Exploit Status
Exploitation requires access to AutoGPT interface and knowledge of internal IPv6 services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: autogpt-platform-beta-v0.4.2
Vendor Advisory: https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4c8v-hwxc-2356
Restart Required: No
Instructions:
1. Update AutoGPT to version autogpt-platform-beta-v0.4.2 or later. 2. Verify the update by checking the version. 3. No restart required for the fix to take effect.
🔧 Temporary Workarounds
Network Segmentation
allRestrict AutoGPT server's network access to only necessary external services and block access to internal IPv6 networks.
Input Validation
allImplement custom input validation to reject IPv6 addresses in the 'Send Web Request' component.
🧯 If You Can't Patch
- Disable or restrict access to the 'Send Web Request' component if not required.
- Implement network-level filtering to block the AutoGPT server from accessing internal IPv6 addresses.
🔍 How to Verify
Check if Vulnerable:
Check if AutoGPT version is earlier than autogpt-platform-beta-v0.4.2 and if the 'Send Web Request' component is enabled.Check Version:
Check AutoGPT configuration or deployment manifest for version information.Verify Fix Applied:
Verify the version is autogpt-platform-beta-v0.4.2 or later and test that IPv6 addresses are properly filtered in the 'Send Web Request' component.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound requests from AutoGPT server to IPv6 addresses
- Failed attempts to access internal IPv6 services
Network Indicators:
- Outbound connections from AutoGPT server to unexpected IPv6 destinations
- Traffic to internal IPv6 services from AutoGPT server
SIEM Query:
source_ip:AutoGPT_server_ip AND dest_ip:IPv6_address AND protocol:HTTP/HTTPS🔗 References
- https://boatneck-faucet-cba.notion.site/SSRF-of-AutoGPT-153b650a4d88804d923ad65a015a7d61
- https://github.com/Significant-Gravitas/AutoGPT/blob/2121ffd06b26a438706bf642372cc46d81c94ddc/autogpt_platform/backend/backend/util/request.py#L11
- https://github.com/Significant-Gravitas/AutoGPT/commit/26214e1b2c6777e0fae866642b23420adaadd6c4
- https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4c8v-hwxc-2356
