AstrBot vulnerabilities

A security flaw in AstrBotDevs AstrBot up to 4.25.5 involves incorrect authorization in the function _build_handoff_toolset of the Subagent component. The attack can be launched remotely. Exploit is publicly available.

A vulnerability in AstrBotDevs AstrBot up to 4.25.5 involves incorrect authorization in an unknown function of astrbot/core/astr_main_agent.py via manipulation of the req.func_tool argument. The attack can be launched remotely. Exploit is publicly available.

A vulnerability was found in AstrBot up to version 4.25.5 in the _normalize_rw_path function of the fs.py file in the Filesystem Computer-Use Tool component. The flaw allows link following with local access. The exploit is public and the vendor did not respond.

A vulnerability in AstrBot up to version 4.25.5 affects the OpenApiRoute.chat_send function in open_api.py. Manipulating the Username argument in the API allows authentication bypass via spoofing. The attack can be launched remotely and exploit details are publicly available.

A flaw in AstrBot up to version 4.25.5 affects the OpenApiRoute.get_chat_sessions function in astrbot/dashboard/routes/open_api.py. Manipulation of the Username argument in the session-listing endpoint leads to authorization bypass. The attack is remotely exploitable and a public exploit exists.

A server-side request forgery (SSRF) vulnerability was found in AstrBot up to version 4.25.2 in the plugin update handler component. An attacker can remotely manipulate the download_url, download_urls, or proxy arguments to send requests to internal network resources. The exploit is publicly available.

The Star.text_to_image/NetworkRenderStrategy.render function in the file astrbot/core/star/base.py in AstrBot up to version 4.25.2 is vulnerable to XSS. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.

A server-side request forgery (SSRF) vulnerability has been detected in AstrBot up to version 4.25.2 in the MCP Test Endpoint component. The issue affects the ToolsRoute.test_mcp_connection function in the file astrbot/dashboard/routes/tools.py, where an attacker can manipulate the mcp_server_config.url argument. The vulnerability has been publicly disclosed and can be exploited remotely.

A server-side request forgery (SSRF) vulnerability has been identified in AstrBot up to version 4.25.2. The issue exists in the get_online_plugins function within astrbot/dashboard/routes/plugin.py, where manipulation of the custom_registry argument in the market_list endpoint allows remote exploitation. The exploit has been publicly disclosed, increasing the risk of attacks.

A security flaw in the Scheduled Task Handler component of AstrBot up to version 4.25.2 affects the FutureTaskTool.call function in astrbot/core/tools/cron_tools.py. Manipulating the payload["note"] argument causes improper authorization, allowing remote exploitation. The exploit has been publicly released and may be used in attacks.

A security flaw was discovered in AstrBotDevs AstrBot 4.23.6. It affects unknown code in the file /api/skills/delete of the API Endpoint component. Manipulating the Name argument results in path traversal. The attack can be initiated remotely. The exploit has been released.

Vulnerability in AstrBot (AstrBotDevs) version 4.24.2 allows authorization bypass by manipulating the session_id argument in the astr_main_agent function of the file astrbot/core/astr_main_agent.py.

An incorrect authorization vulnerability was found in AstrBot 4.23.6 in the function _normalize_rw_path in file astrbot/core/tools/computer_tools/fs.py. The attack can be performed remotely, and the exploit is publicly available. The vendor did not respond to the disclosure.

A vulnerability was found in AstrBot version 4.23.6 in the function _sanitize_prompt_description of file astrbot/core/skills/skill_manager.py, allowing remote injection. The exploit has been made public, and the vendor did not respond.

In AstrBot up to 4.23.5, the post_file function in astrbot/dashboard/routes/chat.py (File Upload Handler component) is vulnerable to path traversal via manipulation of the filename argument. The attack can be launched remotely and the exploit is publicly available. Upgrading to version 4.23.6 is recommended.

AstrBot 3.5.15 contains a hardcoded private key 'Advanced_System_for_Text_Response_and_Bot_Operations_Tool' used to sign JWT.

A security flaw was discovered in AstrBot up to 4.22.1 affecting the create_template function in astrbot/dashboard/routes/t2i.py (Dashboard API component). Manipulation results in improper neutralization of special elements used in a template engine. The attack can be executed remotely and the exploit has been released publicly.

A vulnerability was identified in AstrBotDevs AstrBot up to 4.22.1. The affected element is the post_data.get function of the API Endpoint component. Such manipulation leads to server-side request forgery. The attack may be performed remotely and the exploit is publicly available. The project was informed but has not responded.

A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1 in the add_mcp_server function of astrbot/dashboard/routes/tools.py within the MCP Endpoint component. Manipulation of the command argument causes command injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized; the project was informed but has not responded.

In AstrBot up to 4.22.1, the install_plugin_upload function in astrbot/dashboard/routes/plugin.py (install-upload endpoint) mishandles the File argument, resulting in a sandbox issue. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.