Overly permissive CORS / CSRF in db-gpt (CVE-2024-10906)
Date: 2024
Affected: eosphoros-ai/db-gpt 0.6.0
Attack vector: other
Category: vulnerability-disclosure
Severity: High

db-gpt 0.6.0 dbgpt_server uses a permissive CORSMiddleware that sets Access-Control-Allow-Origin to * for all requests, enabling CSRF and cross-origin attacks.


Mitigations:

Architectural layers (MAESTRO):