DB-GPT Unauthenticated Remote Code Execution Vulnerability

DB-GPT through 0.8.2 is vulnerable to an unauthenticated remote code execution flaw. The /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that grants every caller the admin role.

Unauthenticated attackers can send prompts that make the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools run arbitrary Python or bash as root in the webserver container.

• Affected versions: through 0.8.2
• Attackers can also reach the bundled database using default credentials.