DB-GPT Unauthenticated Path Traversal Leading to Remote Code Execution

Technical Analysis

The vulnerability resides in skill_upload (agentic_data_api.py), which concatenates upload_dir with the raw, attacker-supplied file.filename using a path join operation that silently discards the base directory when the filename is absolute (e.g., /tmp/x) or traverses upward when relative (e.g., ../../../tmp/x), with no canonicalization, containment check, or extension allow-listing performed afterward. The endpoint's sole authorization check, get_user_from_headers, unconditionally returns an admin-role identity regardless of whether credentials are supplied, effectively removing authentication from this and potentially other routes relying on the same dependency. An unauthenticated attacker can therefore write a malicious .py file into the DB-GPT application package directory or overwrite an existing imported module, achieving remote code execution in the server process the next time that module is loaded. This is a critical, pre-auth RCE (CVSS 9.8) chain combining CWE-22 (Path Traversal) and CWE-306 (Missing Authentication for Critical Function). Because DB-GPT is used as an AI agent orchestration and RAG-enabling framework, exploitation directly compromises hosts running autonomous agents, exposing LLM API keys, tool-use credentials, vector store contents, and enabling supply-chain-style poisoning of agent behavior via injected code.

Affected Systems

DB-GPT deployments exposing the agentic_data_api skill_upload endpoint (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py) in versions relying on the vulnerable get_user_from_headers implementation in dbgpt_serve/utils/auth.py; self-hosted and internet-facing DB-GPT instances without additional network-layer authentication or WAF path-traversal filtering are at highest risk.

Indicators of Compromise

• Anomalous multipart file uploads with filenames containing ../ or absolute paths (e.g., /tmp/x, ../../../tmp/x.py)
• Unexpected .py files created or modified within DB-GPT application package directories
• Requests to skill_upload endpoint lacking a user_id header yet processed with admin privileges
• Unexplained process restarts or module reloads on DB-GPT server correlating with file writes outside upload_dir

Remediation Steps

1. 1

   Patch or upgrade DB-GPT

   Apply the vendor patch or upgrade to a fixed release that canonicalizes upload paths, enforces containment within upload_dir, and restricts allowed file extensions.

2. 2

   Fix authentication dependency

   Ensure get_user_from_headers (or equivalent auth logic) properly validates identity and rejects requests lacking a valid user_id/credential rather than defaulting to admin role.

3. 3

   Restrict network exposure

   Place DB-GPT instances behind authenticated reverse proxies or VPNs and block direct internet access to the skill_upload API until patched.

4. 4

   Sanitize and validate filenames

   Implement server-side filename normalization (basename extraction), reject path separators and traversal sequences, and disallow writable executable extensions such as .py.

5. 5

   Audit for compromise

   Inspect application package directories for unauthorized or recently modified Python files, review server logs for suspicious upload requests, and rotate any credentials or API keys accessible to the compromised process.

6. 6

   Rotate exposed secrets

   If exploitation is suspected, rotate LLM API keys, database credentials, and any agent tool-use secrets accessible from the DB-GPT server environment.