CVE-2024-6091 - CVE House

Back to Database

Status published Critical CVE-2024-6091

Shell Command Denylist Bypass in significant-gravitas/autogpt

9.8 CVSS

Vulnerability Description

A vulnerability in significant-gravitas/autogpt version 0.5.1 allows an attacker to bypass the shell commands denylist settings. The issue arises when the denylist is configured to block specific commands, such as 'whoami' and '/bin/whoami'. An attacker can circumvent this restriction by executing commands with a modified path, such as '/bin/./whoami', which is not recognized by the denylist.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-6091

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from significant-gravitas

View All →

Server-Side Template Injection (SSTI) in significant-gravitas/autogpt

SSRF Check Bypass in Requests Utility in significant-gravitas/autogpt

Command Injection in significant-gravitas/autogpt

Improper Neutralization of Special Elements used in an OS Command in significant-gravitas/autogpt

OS Command Injection in MacOS Text-To-Speech Class in significant-gravitas/autogpt

Affected Vendor

significant-gravitas

View all reports →

Affected Software

significant-gravitas/autogpt

Vulnerable Versions:

unspecified

Timeline

Official Publish: September 11th, 2024

Last Modified: September 11th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel