CVE-2024-10707
📋 TL;DR
This vulnerability allows unauthenticated attackers to read arbitrary files on servers running vulnerable versions of gaizhenbiao/chuanhuchatgpt. The issue stems from improper input validation in the handle_dataset_selection function when processing uploaded JSON files. Anyone using the affected version of this software is at risk.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Complete server file system disclosure including sensitive configuration files, credentials, and user data
Likely Case
Unauthorized access to sensitive files containing API keys, configuration data, or user information
If Mitigated
Limited impact with proper file permissions and network segmentation
🎯 Exploit Status
Exploitation requires uploading a specially crafted JSON file to trigger the vulnerability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to version after git commit d4ec6a3
Vendor Advisory: https://huntr.com/bounties/98fdedea-6ad0-4157-b7d2-ae71c9786ee8
Restart Required: Yes
Instructions:
1. Pull latest version from repository
2. Update gradio dependency to patched version
3. Restart the application
🔧 Temporary Workarounds
Disable file upload functionality
allTemporarily disable JSON file uploads until patching is complete
Implement input validation
allAdd strict input validation for JSON file uploads
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy web application firewall with file inclusion protection rules
🔍 How to Verify
Check if Vulnerable:
Check if using gaizhenbiao/chuanhuchatgpt version git d4ec6a3 or earlierCheck Version:
git log --oneline -1Verify Fix Applied:
Verify gradio component is updated to version without CVE-2024-4941📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from JSON upload endpoints
- Multiple failed file inclusion attempts
Network Indicators:
- Unusual JSON file uploads to the application
SIEM Query:
source="application_logs" AND ("handle_dataset_selection" OR "gr.JSON") AND ("file://" OR "../")