CVE-2024-10906: Dbgpt Db-gpt CSRF Vulnerability

CVE-2024-10906 Overview

CVE-2024-10906 is a Cross-Site Request Forgery (CSRF) vulnerability affecting version 0.6.0 of eosphoros-ai/db-gpt. The uvicorn application created by dbgpt_server configures CORSMiddleware with Access-Control-Allow-Origin set to * for all requests. This overly permissive setting exposes every endpoint to cross-origin attacks. An attacker can lure an authenticated user to a malicious page and trigger requests against any db-gpt endpoint, including instances that are not publicly reachable from the internet. The flaw maps to CWE-352: Cross-Site Request Forgery.

Critical Impact
Attackers can invoke arbitrary db-gpt endpoints from a victim's browser, enabling unauthorized data modification and service disruption on internal deployments.

Affected Products

eosphoros-ai/db-gpt version 0.6.0
Deployments running dbgpt_server with default CORS configuration
Internal and non-public db-gpt instances accessible from a victim's browser

Discovery Timeline

2025-03-20 - CVE-2024-10906 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10906

Vulnerability Analysis

The db-gpt server initializes a FastAPI/uvicorn application and attaches CORSMiddleware configured to allow any origin. With Access-Control-Allow-Origin: * applied to all routes, browsers do not enforce same-origin restrictions on cross-domain requests. Combined with endpoints that perform state-changing actions without CSRF tokens, this enables an attacker-controlled origin to issue requests that the browser will deliver to the db-gpt service.

The attack vector is network-based and requires user interaction, typically clicking a link or visiting a crafted page. Successful exploitation produces high integrity and availability impact, since attackers can invoke administrative operations on the AI data platform.

Root Cause

The root cause is insecure default configuration of the CORS policy combined with the absence of anti-CSRF protections such as request tokens, SameSite cookie attributes, or origin validation. The wildcard origin policy treats all cross-origin requests as trusted, which violates the principle of least privilege for browser-driven access control.

Attack Vector

An attacker hosts a malicious page that issues fetch or form requests to the db-gpt server. When a logged-in user visits the page, the browser sends the requests with the user's session context. Because the server returns permissive CORS headers and lacks CSRF tokens, the requests execute against any exposed endpoint, including data ingestion, configuration, or query interfaces. The attack works against internal instances as long as the victim's browser can resolve the target.

No verified exploit code is published. Technical details are available in the Huntr Bug Bounty Report.

Detection Methods for CVE-2024-10906

Indicators of Compromise

Unexpected state-changing requests to db-gpt endpoints with Origin or Referer headers pointing to unfamiliar external domains
HTTP responses from dbgpt_server containing Access-Control-Allow-Origin: * on authenticated routes
Unusual sequences of API calls originating from browser sessions outside normal administrator workflows

Detection Strategies

Inspect db-gpt deployments for CORSMiddleware initialization that sets allow_origins=["*"] in the server bootstrap code
Review reverse proxy and application logs for cross-origin POST, PUT, and DELETE requests targeting db-gpt routes
Correlate web proxy telemetry to identify users visiting suspicious sites immediately before anomalous db-gpt API activity

Monitoring Recommendations

Forward db-gpt access logs to a centralized analytics platform and alert on requests with mismatched Origin and Host headers
Track configuration drift on production db-gpt instances to detect reintroduction of permissive CORS settings
Monitor outbound user traffic for known CSRF payload delivery infrastructure flagged by threat intelligence feeds

How to Mitigate CVE-2024-10906

Immediate Actions Required

Restrict the CORSMiddlewareallow_origins list to an explicit allowlist of trusted application origins
Disable wildcard credentials handling and require allow_credentials=False unless strictly needed with a defined origin list
Place db-gpt behind an authenticated reverse proxy that enforces Origin and Referer validation

Patch Information

No vendor patch URL is listed in the NVD record. Operators should upgrade to a release later than 0.6.0 if available and review the Huntr Bug Bounty Report for remediation guidance from the maintainers.

Workarounds

Configure session cookies with SameSite=Strict or SameSite=Lax to limit cross-origin transmission
Add CSRF tokens to state-changing endpoints and validate them server-side on each request
Network-segment db-gpt instances so that browsers on user workstations cannot reach administrative interfaces directly

bash

# Configuration example: restrict CORS to a trusted origin
# Replace permissive wildcard with explicit allowlist in dbgpt_server startup
app.add_middleware(
    CORSMiddleware,
    allow_origins=["https://dbgpt.internal.example.com"],
    allow_credentials=True,
    allow_methods=["GET", "POST"],
    allow_headers=["Authorization", "Content-Type"],
)