FastGPT Unauthenticated Plugin System Access Vulnerability

A vulnerability in FastGPT versions 4.14.0 to 4.14.5 allows attackers to access the plugin system without authentication, through the FastGPT/api/plugin/xxx endpoint. This unauthorized access can disrupt the plugin system, potentially causing it to crash and leading to a loss of plugin installation status. However, it does not result in key leakage. In earlier versions, the impact is minimal as the available interfaces only provide informational access.

Impact

Exploitation of this vulnerability can cause the plugin system to crash and result in the loss of plugin installation status.

Remediation

Users are advised to upgrade to FastGPT version 4.14.5-fix. Alternatively, through gateway rules, disable all requests to '{{FastGPT host}}/api/plugin/*'.