CVE-2024-10901 CRITICAL

CVE-2024-10901: Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt

Vendor Eosphoros-Ai
Product eosphoros-ai/db-gpt
Weakness CWE-434 · Unrestricted file upload
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE) by writing malicious files such as `__init__.py` in the Python's `/site-packages/` directory.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated