CVE-2025-0454: AutoGPT Platform SSRF Vulnerability

CVE-2025-0454 Overview

CVE-2025-0454 is a Server-Side Request Forgery (SSRF) vulnerability in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The flaw stems from inconsistent hostname parsing between Python's urllib.parse.urlparse function and the requests library. An attacker can submit a crafted URL such as http://localhost:\@google.com/../ to bypass the SSRF host validation logic. Once bypassed, the application issues requests to attacker-chosen internal destinations, including loopback services and cloud metadata endpoints. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can bypass SSRF protections to make the AutoGPT backend issue arbitrary HTTP requests to internal network resources.

Affected Products

significant-gravitas/autogpt versions prior to v0.4.0
AutoGPT Platform backend (autogpt_platform/backend)
Deployments using the AutoGPT Requests utility for outbound HTTP calls

Discovery Timeline

2025-03-20 - CVE-2025-0454 published to NVD
2025-08-05 - Last updated in NVD database

Technical Details for CVE-2025-0454

Vulnerability Analysis

The AutoGPT Requests utility validates outbound URLs before forwarding them to the requests library. Validation relies on urlparse from urllib.parse to extract the hostname and confirm the target is not an internal resource. The requests library, however, parses the same URL using different rules. This parser mismatch allows an attacker to craft a URL where urlparse extracts a benign-looking hostname while requests resolves and connects to a different host. The result is a complete SSRF check bypass against the agent's HTTP fetching functionality.

Root Cause

The root cause is hostname confusion between two URL parsers. In the input http://localhost:\@google.com/../, urlparse interprets localhost as the host because of the backslash, while requests follows RFC 3986 userinfo semantics and treats localhost:\ as credentials and google.com as the host. Because the allowlist or denylist checks rely on urlparse's output, the malicious target slips through.

Attack Vector

An attacker exploits the vulnerability by submitting a crafted URL to any AutoGPT agent or block that invokes the vulnerable Requests utility. No authentication or user interaction is required when the endpoint accepts unauthenticated input. The server then issues an HTTP request to an attacker-controlled destination, internal service, or cloud metadata endpoint such as 169.254.169.254, potentially returning sensitive response data to the attacker.

text

# Example of the malformed URL that triggers parser confusion
http://localhost:\@google.com/../

# urlparse() sees:  hostname = "localhost"   -> passes SSRF check
# requests sends:   Host: google.com        -> request goes elsewhere

Detection Methods for CVE-2025-0454

Indicators of Compromise

Outbound HTTP requests from AutoGPT backend hosts to internal RFC1918 addresses or 127.0.0.1
Requests to cloud metadata endpoints such as 169.254.169.254 originating from AutoGPT processes
URL inputs containing backslash characters, embedded @ symbols, or userinfo fragments combined with localhost
Application logs showing urlparse hostnames that differ from the eventual Host header in egress traffic

Detection Strategies

Inspect AutoGPT request logs for URLs matching patterns like ://localhost.*@, ://127\.0\.0\.1.*@, or backslash sequences in the authority component
Correlate urlparse-derived hostnames recorded by the SSRF check with the destination IPs observed at the egress proxy or firewall
Alert on AutoGPT worker processes initiating connections to private CIDR ranges, link-local addresses, or cloud metadata IPs

Monitoring Recommendations

Forward AutoGPT application and egress proxy logs to a centralized analytics platform and build queries on hostname mismatch events
Enforce egress filtering at the network layer and alert on any blocked attempt to reach 169.254.169.254 or internal services from AutoGPT nodes
Track the installed version of significant-gravitas/autogpt across environments and flag any host running a release earlier than v0.4.0

How to Mitigate CVE-2025-0454

Immediate Actions Required

Upgrade significant-gravitas/autogpt to v0.4.0 or later, which includes the fix from commit ff065cd
Restrict outbound network access from AutoGPT workers using an egress firewall or proxy that denies traffic to RFC1918, loopback, and metadata addresses
Audit historical logs for crafted URLs containing \@ or userinfo patterns that may indicate prior exploitation attempts

Patch Information

The maintainers fixed the SSRF bypass in the AutoGPT Platform backend. The patch is referenced by Huntr bounty submission 0664fdee-bdc2-4650-8075-74d7b8d3e308 and merged via commit ff065cd24c2289878c0abdb9adbf91c305f0d70a. The change updates the Requests utility validation logic and dependency lockfiles in autogpt_platform/backend/pyproject.toml and poetry.lock. Source: GitHub Commit Details.

Workarounds

Place AutoGPT backend services behind an egress proxy that rejects requests to private, loopback, and link-local addresses
Reject any user-supplied URL containing backslashes, embedded credentials, or non-ASCII authority characters before invoking the Requests utility
Resolve the hostname using the same library that performs the HTTP request and revalidate the resolved IP against an SSRF denylist

bash

# Pin AutoGPT backend to a fixed release with the SSRF patch
pip install --upgrade "agpt>=0.4.0"

# Verify installed version
python -c "import agpt; print(agpt.__version__)"