AutoGPT DNS rebinding vulnerability allows credential leakage via SSRF
AutoGPT's custom HTTP request wrapper failed to remove authentication headers when following redirects to different domains, potentially allowing attackers to steal API credentials through DNS rebinding or open redirect attacks. The vulnerability was patched in version 0.6.1.
What happened
AutoGPT versions up to 0.6.0 contained a custom wrapper around the Python requests library that handled HTTP redirects manually instead of using the library's built-in redirect following.
The wrapper did not strip security-sensitive headers (Authorization, Proxy-Authorization, Cookie) when following redirects to different domains, unlike the standard requests library which removes these headers across origin boundaries.
An attacker could exploit this through a DNS rebinding attack or open redirect vulnerability to trick AutoGPT into sending authentication credentials to an attacker-controlled server.
Reported impact
If AutoGPT were directed to a service with an open redirect vulnerability (such as a hypothetical GitHub API endpoint), an attacker could intercept authentication headers and gain access to protected resources like the GitHub API using the victim's credentials.
Index analysis
The vulnerability exists in the manual redirect handling code located in autogpt_platform/backend/backend/util/request.py, which processes redirects by extracting the Location header and re-requesting the new URL without sanitizing cross-origin headers.
AutoGPT's fix, released in version 0.6.1, implements a _remove_insecure_headers function that strips sensitive headers when the redirect changes the scheme, hostname, or port, and adds DNS rebinding protections to the URL validation logic.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.