CVE-2023-34094
📋 TL;DR
This vulnerability allows unauthenticated attackers to access the config.json file in ChuanhuChatGPT deployments without authentication configured. This exposes API keys and other sensitive configuration data. Anyone running ChuanhuChatGPT versions 20230526 or earlier without authentication is affected.
💻 Affected Systems
- ChuanhuChatGPT
📦 What is this software?
Chuanhuchatgpt by Chuanhuchatgpt Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal API keys, gain unauthorized access to LLM services, incur financial costs from API abuse, and potentially access other integrated services.
Likely Case
Unauthorized access to configuration files leading to API key theft and potential service abuse.
If Mitigated
No impact if proper authentication is configured or patched version is deployed.
🎯 Exploit Status
Simple HTTP request to access config.json file. No authentication bypass needed when auth is disabled.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit bfac445 and later
Vendor Advisory: https://github.com/GaiZhenbiao/ChuanhuChatGPT/security/advisories/GHSA-j34w-9xr4-m9p8
Restart Required: Yes
Instructions:
1. Update to latest version from GitHub repository. 2. Pull commit bfac445 or later. 3. Restart the ChuanhuChatGPT service.
🔧 Temporary Workarounds
Enable Authentication
allConfigure access authentication for ChuanhuChatGPT deployment
Configure authentication in ChuanhuChatGPT settings or deployment configuration
🧯 If You Can't Patch
- Implement network-level access controls to restrict access to ChuanhuChatGPT
- Move config.json to protected directory with proper file permissions
🔍 How to Verify
Check if Vulnerable:
Check if config.json is accessible via HTTP without authentication. Try accessing /config.json or similar endpoints.Check Version:
Check ChuanhuChatGPT version in interface or deployment configurationVerify Fix Applied:
Verify config.json is no longer accessible without authentication and check version is post-commit bfac445.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to config.json
- Multiple failed authentication attempts
Network Indicators:
- HTTP requests to config.json endpoint from unauthorized sources
SIEM Query:
source="web_server" AND (uri="/config.json" OR uri LIKE "%/config.json") AND response_code=200🔗 References
- https://github.com/GaiZhenbiao/ChuanhuChatGPT/commit/bfac445e799c317b0f5e738ab394032a18de62eb
- https://github.com/GaiZhenbiao/ChuanhuChatGPT/security/advisories/GHSA-j34w-9xr4-m9p8
- https://github.com/GaiZhenbiao/ChuanhuChatGPT/commit/bfac445e799c317b0f5e738ab394032a18de62eb
- https://github.com/GaiZhenbiao/ChuanhuChatGPT/security/advisories/GHSA-j34w-9xr4-m9p8
