Internet of Agents flaws allow unauthenticated access and code injection
Anyone can get into this AI agent program and control the server.
Summary
Several features of OpenBMB Internet of Agents, including connection management, agent registration and message lookup, lack authentication or access checks, so a remote attacker can connect or manipulate the server. Versions up to commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a are affected, and public exploit code is reported.
What to do
No fixed version has been published, and the project has not responded to the report. Check that the code you run is newer than commit 9d78e88e47160eb42ee1ee8538c05e1c2c47877a, and read the project's official notices.
Products and platforms
CVE IDs
Sources
- Write-up: vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · vuldb.com (opens in a new tab) · github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen