GHSA-r277-3xc5-c79v: AutoGPT is Vulnerable to RCE via Disabled Block Execution
SummaryAutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the `disabled` flag. Any authenticated user can execute the disabled `BlockInstallationBlock`, which writes arbitrary Python code to the server filesystem and executes it via `__import__()`, achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account.Details**Two vulnerable endpoints exist:****Main Web API** ([`v1.py#L355-395`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L355-L395)) - Any authenticated user:**External API** ([`external/v1/routes.py#L79-93`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/external/v1/routes.py#L79-L93)) - Same issue.The external API is gated by API key permissions, but any authenticated user can mint API keys with arbitrary permissions via the main API (including `EXECUTE_BLOCK`) at [`v1.py#L1408-1424`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/api/features/v1.py#L1408-L1424). As a result, a low-privilege user can create an API key and invoke the external block execution route.**The disabled flag is documented but not enforced:**From [`block.py#L459`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/data/block.py#L459):"disabled: If the block is disabled, it will not be available for execution."The block listing endpoint correctly filters disabled blocks (`if not b.disabled`), but the execution endpoints do not check this flag.**The dangerous block ([`blocks/block.py#L15-78`](https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/block.py#L15-L78)):**PoC**1. Create malicious block code****2. Execute via main web API (any logged-in user)**The malicious Python code is written to the server's `backend/blocks/` directory and immediately executed via `__import__()`.**Alternative route:** Mint an API key with `EXECUTE_BLOCK` via `POST /api-keys`, then call the external API `POST /external-api/v1/blocks/{id}/execute`.Impact**Any user who can create an account on AutoGPT Platform can achieve full Remote Code Execution on the backend server.**This allows:Complete server compromiseAccess to all user data, credentials, and API keys stored in the databaseAccess to environment variables (cloud credentials, secrets)Lateral movement to connected infrastructure (Redis, PostgreSQL, cloud services)Persistent backdoor installation**Attack requirements:**Create a free account on the platform (default self-hosted enables signup; hosted deployments may disable signup, requiring an existing account)Know the disabled block's UUID (hardcoded in public source code: `45e78db5-03e9-447f-9395-308d712f5f08`)**Why the `disabled` flag exists but fails:**Block listing correctly filters disabled blocks (users don't see them in UI)Execution endpoints bypass this check entirelyThe UUID is static and publicly known from the open-source codebase**Severity note:** CVSS assumes the default self-hosted configuration where signup is enabled (low-privilege authentication is easy to obtain). If signup is disabled in a hosted deployment, likelihood is lower, but impact remains critical once any authenticated account exists.A fix is available, but was not published to the PyPI registry at time of publication: [0.6.44](https://github.com/Significant-Gravitas/AutoGPT/releases/tag/v0.6.44)
CVSS v4.0: 8.6