CVE-2024-10906: 
Python vulnerability analysis and mitigation

In version 0.6.0 of eosphoros-ai/db-gpt, a critical security vulnerability was identified involving the uvicorn app created by dbgpt_server. The vulnerability stems from an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to * for all requests. This vulnerability was assigned CVE-2024-10906 and was disclosed on March 20, 2025 (NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) vulnerability with a CVSS v3.0 base score of 7.1 (HIGH). The technical root cause is the misconfiguration of CORS policy in the uvicorn app, where the Access-Control-Allow-Origin header is set to *, allowing requests from any origin. The vulnerability has been assigned CWE-352 (Cross-Site Request Forgery) classification (NVD, Huntr).

The vulnerability makes all endpoints exposed by the server vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can potentially interact with any endpoints of the instance, even if the instance is not publicly exposed to the network. This poses a significant risk as it could allow unauthorized actions to be performed on behalf of authenticated users (NVD).