eosphoros-ai/db-gpt Cross-Site Request Forgery Vulnerability via Overly Permissive CORS Configuration

A Cross-Site Request Forgery (CSRF) vulnerability exists in version 0.6.0 of eosphoros-ai/db-gpt. The issue arises because the 'uvicorn' application created by 'dbgpt_server' employs an overly permissive 'CORSMiddleware' instance, allowing all origins to access the server's endpoints. This configuration exposes all endpoints to potential CSRF attacks, enabling an attacker to interact with the server's functionality, regardless of the instance's network visibility.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling attackers to perform actions on behalf of users without their consent.