CVE-2024-10100
📋 TL;DR
A path traversal vulnerability in binary-husky/gpt_academic version 3.83 allows attackers to read arbitrary files on the host system by manipulating the file parameter with URL encoding. This affects all deployments running the vulnerable version, potentially exposing sensitive data like SSH keys, API keys, and configuration files.
💻 Affected Systems
- binary-husky/gpt_academic
📦 What is this software?
Gpt Academic by Binary Husky
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through theft of SSH keys, API credentials, and sensitive configuration data, potentially leading to lateral movement and data exfiltration.
Likely Case
Exposure of sensitive application files, configuration values, and credentials stored on the same server as the vulnerable application.
If Mitigated
Limited impact if proper file system permissions restrict application user access and sensitive files are stored elsewhere.
🎯 Exploit Status
The vulnerability requires no authentication and exploitation is straightforward via URL manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.84 or later
Vendor Advisory: https://huntr.com/bounties/e58a0fb4-2b1d-49ef-b32e-bb62659a6f99
Restart Required: Yes
Instructions:
1. Update to version 3.84 or later via pip: pip install --upgrade gpt_academic
2. Restart the application service
3. Verify the fix by checking the version
🔧 Temporary Workarounds
File Access Restriction
linuxRestrict application user file system permissions to limit accessible directories
chmod 750 /path/to/application
chown -R appuser:appgroup /path/to/application
Web Server Configuration
allConfigure web server to block path traversal attempts in URLs
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the vulnerable application
- Move all sensitive files (SSH keys, API keys, configs) to directories inaccessible to the application user
🔍 How to Verify
Check if Vulnerable:
Check if running version 3.83: python -c "import gpt_academic; print(gpt_academic.__version__)"Check Version:
python -c "import gpt_academic; print(gpt_academic.__version__)"Verify Fix Applied:
Verify version is 3.84 or higher using the same command📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in application logs
- Requests with encoded path traversal sequences (../, %2e%2e%2f)
Network Indicators:
- HTTP requests with URL-encoded path traversal sequences in file parameter
SIEM Query:
source="web_server" AND (uri="*%2e%2e%2f*" OR uri="*..%2f*")