Description

The autogpt is vulnerable to Regular Expression Denial of Service due to the use of regex at Code Extraction Block. The vulnerable code is:

pattern = (
    r"```(?:"
    + "|".join(
        re.escape(alias)
        for aliases in language_aliases.values()
        for alias in aliases
    )
    + r")\s+[\s\S]*?```"
)

and

pattern = re.compile(rf"```{language}\s+(.*?)```", re.DOTALL | re.IGNORECASE)

The two Regex are used containing the corresponding dangerous patterns \s+[\s\S]*? and \s+(.*?). They share a common characteristic — the combination of two adjacent quantifiers that can match the same space character (\s). As a result, an attacker can supply a long sequence of space characters to trigger excessive regex backtracking, potentially leading to a Denial of Service (DoS).

PoC

Attacker can exploit this vulnerability to conduct DoS attack by:

• Create Code Extraction Block

• Then, save the agent

• Run the Python code below to generate a payload and save it to a file:

with open("output.txt", "w") as f:
    f.write("```html" + " " * 200000)

• Copy the payload from this file

• Paste into the text input → Click Save → Click Run

• Observe that it take over 8 minutes to run successfully. Larger inputs will take more time.

• Performing a few runs with the same input can cause CPU exhaustion.

Impact

An attacker can exploit this by providing maliciously crafted input strings. This forces the application into intensive processing, resulting in:

• High CPU usage
• Potential application downtime Effectively, this creates a Denial of Service (DoS) scenario.

Remediation

The sub-pattern \s+[\s\S]*? and \s+(.*?) can be replaced by [ \t]*\n([\s\S]*?)

Occurrences

https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/code_extraction_block.py#L86-L96
https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/code_extraction_block.py#L106-L109