CVE-2024-10906: 
Python vulnerability analysis and mitigation

In version 0.6.0 of eosphoros-ai/db-gpt, a critical security vulnerability was identified involving the uvicorn app created by dbgpt_server. The vulnerability stems from an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to * for all requests. This vulnerability was assigned CVE-2024-10906 and was disclosed on March 20, 2025 (NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) vulnerability with a CVSS v3.0 base score of 7.1 (HIGH). The technical root cause is the misconfiguration of CORS policy in the uvicorn app, where the Access-Control-Allow-Origin header is set to *, allowing requests from any origin. The vulnerability has been assigned CWE-352 (Cross-Site Request Forgery) classification (NVD, Huntr).

The vulnerability makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can potentially interact with any endpoints of the instance, even if the instance is not publicly exposed to the network. This poses a significant risk as it could allow unauthorized actions to be performed on behalf of authenticated users (NVD).

The vulnerability is exploitable remotely and requires low attack complexity. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring no privileges (PR:N) but does need user interaction (UI:R). The scope is unchanged (S:U) with high impact on integrity (I:H) and low impact on availability (A:L) (NVD).