Summary
DB-GPT's ReAct agent endpoint may accept requests without verifying the caller's identity because it relies on a mock header-based user lookup that assigns administrative privileges broadly. An unauthenticated attacker could abuse exposed interpreter tools to execute arbitrary Python or Bash commands with the privileges of the webserver container, potentially as root.
DB-GPT's ReAct agent endpoint may accept requests without verifying the caller's identity because it relies on a mock header-based user lookup that assigns administrative privileges broadly. An unauthenticated attacker could abuse exposed interpreter tools to execute arbitrary Python or Bash commands with the privileges of the webserver container, potentially as root.
Affected context
The issue affects DB-GPT deployments through version 0.8.2 when the following conditions are present:
- The
/api/v1/chat/react-agentendpoint is reachable by an attacker. - Authentication is delegated to a mock or otherwise ineffective header-based user lookup.
- The ReAct agent can invoke unsandboxed Python and shell interpreter tools.
- The webserver container has elevated privileges or access to bundled databases and other sensitive resources.
The issue affects DB-GPT deployments through version 0.8.2 when the following conditions are present:
- The
/api/v1/chat/react-agentendpoint is reachable by an attacker. - Authentication is delegated to a mock or otherwise ineffective header-based user lookup.
- The ReAct agent can invoke unsandboxed Python and shell interpreter tools.
- The webserver container has elevated privileges or access to bundled databases and other sensitive resources.
Exploit preconditions
- Attack surface: The exposed
/api/v1/chat/react-agentHTTP endpoint - Required access: Network reachability only; valid authentication may not be required when the mock identity function is active
- Trigger point: Processing attacker-controlled prompts by the ReAct agent
- Why exploitation is possible: The endpoint can treat unauthenticated callers as administrators and permit interpreter tools to execute commands in the server environment
- Attack surface: The exposed
/api/v1/chat/react-agentHTTP endpoint - Required access: Network reachability only; valid authentication may not be required when the mock identity function is active
- Trigger point: Processing attacker-controlled prompts by the ReAct agent
- Why exploitation is possible: The endpoint can treat unauthenticated callers as administrators and permit interpreter tools to execute commands in the server environment
Why this happens
The underlying flaw is an authentication enforcement failure. A mock get_user_from_headers implementation does not reliably establish caller identity and can grant administrative privileges without validating credentials, mapping to CWE-306: Missing Authentication for Critical Function.
The risk is amplified because privileged agent capabilities are connected to unsandboxed Python and shell interpreters. This creates an insecure trust boundary in which user-controlled agent instructions can reach operating-system execution functionality.
The underlying flaw is an authentication enforcement failure. A mock get_user_from_headers implementation does not reliably establish caller identity and can grant administrative privileges without validating credentials, mapping to CWE-306: Missing Authentication for Critical Function.
The risk is amplified because privileged agent capabilities are connected to unsandboxed Python and shell interpreters. This creates an insecure trust boundary in which user-controlled agent instructions can reach operating-system execution functionality.
Potential impact
- An attacker may execute arbitrary Python or shell commands in the webserver container.
- The attacker could obtain or modify application data and configuration.
- Sensitive database contents may be disclosed or altered.
- The container could be used for persistence, lateral movement, or further compromise.
- Running commands with root-level container privileges could increase the scope of impact.
- An attacker may execute arbitrary Python or shell commands in the webserver container.
- The attacker could obtain or modify application data and configuration.
- Sensitive database contents may be disclosed or altered.
- The container could be used for persistence, lateral movement, or further compromise.
- Running commands with root-level container privileges could increase the scope of impact.
General mitigation guidance
Mitigation generally focuses on enforcing real authentication and authorization before exposing privileged agent capabilities.
Common defensive patterns include:
- Replacing mock identity resolution with a trusted authentication mechanism that rejects missing or invalid credentials.
- Applying explicit authorization checks to agent endpoints and administrative tools.
- Disabling shell and arbitrary-code interpreters by default when they are not essential.
- Running required tools inside tightly restricted sandboxes with minimal filesystem, network, and process permissions.
- Applying least-privilege identities to the webserver and its container.
- Reducing access to bundled databases, secrets, and service credentials.
- Treating prompts and agent outputs as untrusted input rather than as authorization to perform sensitive operations.
Mitigation generally focuses on enforcing real authentication and authorization before exposing privileged agent capabilities.
Common defensive patterns include:
- Replacing mock identity resolution with a trusted authentication mechanism that rejects missing or invalid credentials.
- Applying explicit authorization checks to agent endpoints and administrative tools.
- Disabling shell and arbitrary-code interpreters by default when they are not essential.
- Running required tools inside tightly restricted sandboxes with minimal filesystem, network, and process permissions.
- Applying least-privilege identities to the webserver and its container.
- Reducing access to bundled databases, secrets, and service credentials.
- Treating prompts and agent outputs as untrusted input rather than as authorization to perform sensitive operations.
How teams detect issues like this
Organizations can look for:
- Static analysis findings involving mock authentication functions, unconditional administrator assignments, or authentication checks that accept missing headers.
- Code review signals where externally reachable agent routes invoke shell, Python, or other dynamic execution tools.
- API and integration tests confirming that unauthenticated requests receive denial responses and that non-administrative users cannot invoke privileged tools.
- Runtime logs showing anonymous requests, unexpected administrator identities, interpreter invocation, or unusual child-process creation.
- Policy enforcement that blocks privileged agent tools unless authentication, authorization, sandboxing, and resource limits are all present.
Automated security review tools may help identify missing access-control checks and dangerous execution paths, but should be supplemented with deployment-level testing.
Organizations can look for:
- Static analysis findings involving mock authentication functions, unconditional administrator assignments, or authentication checks that accept missing headers.
- Code review signals where externally reachable agent routes invoke shell, Python, or other dynamic execution tools.
- API and integration tests confirming that unauthenticated requests receive denial responses and that non-administrative users cannot invoke privileged tools.
- Runtime logs showing anonymous requests, unexpected administrator identities, interpreter invocation, or unusual child-process creation.
- Policy enforcement that blocks privileged agent tools unless authentication, authorization, sandboxing, and resource limits are all present.
Automated security review tools may help identify missing access-control checks and dangerous execution paths, but should be supplemented with deployment-level testing.
