AutoGPT SSRF vulnerability via IPv6 address bypass
AutoGPT's Send Web Request component contained a server-side request forgery vulnerability that allowed attackers to bypass IPv4 restrictions and access IPv6 services, including internal addresses like [::1]:2333. The vulnerability affected versions up to v0.4.1 and was patched in v0.4.2 with improved filtering of IPv6 address ranges.
What happened
AutoGPT Beta versions up to v0.4.1 contained an SSRF vulnerability in the Send Web Request component that failed to filter IPv6 addresses, while IPv4 private networks were blocked.
Attackers could instruct the LLM to visit IPv6 addresses such as [::1]:2333 to access internal services, bypassing the existing IPv4 restrictions.
Reported impact
The vulnerability allows server-side request forgery attacks to internal IPv6 services that should be blocked from external access.
Index analysis
The root cause was incomplete filtering of IP address ranges in the request validation logic, which only blocked IPv4 private networks but not their IPv6 equivalents.
The fix in v0.4.2 added IPv6 ranges to the blocked list, including ::1/128 (loopback), fc00::/7 (unique local addresses), fe80::/10 (link-local), and ff00::/8 (multicast).
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.