CVE-2025-0454 Information

Description

A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious user can exploit this by submitting a specially crafted URL such as http://localhost:\@google.com/../ to bypass the SSRF check and perform an SSRF attack.

Reference

https://github.com/significant-gravitas/autogpt/commit/ff065cd24c2289878c0abdb9adbf91c305f0d70a https://huntr.com/bounties/0664fdee-bdc2-4650-8075-74d7b8d3e308 A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnerability arises due to a hostname confusion between the urlparse function from the urllib.parse library and the requests library. A malicious user can exploit this by submitting a specially crafted URL such as [***http://localhost:\@google.com/../***](http://localhost:@google.com/../`) to bypass the SSRF check and perform an SSRF attack.