CVE-2024-10819
📋 TL;DR
A CSRF vulnerability in binary-husky/gpt_academic version 3.83 allows attackers to trick authenticated users into uploading malicious files without their consent. This can lead to stored XSS attacks where attackers can steal user information and perform actions on their behalf. Anyone using the vulnerable version of this software is affected.
💻 Affected Systems
- binary-husky/gpt_academic
📦 What is this software?
Gpt Academic by Binary Husky
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, data theft, and potential system compromise through malicious file uploads leading to stored XSS that executes arbitrary actions as the victim.
Likely Case
Unauthorized file uploads leading to stored XSS attacks that steal session cookies and user data, potentially compromising user accounts.
If Mitigated
Limited impact with proper CSRF protections and file upload restrictions in place.
🎯 Exploit Status
Requires user interaction (visiting malicious page while authenticated) and file upload functionality to be accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 3.83
Vendor Advisory: https://huntr.com/bounties/45270c4b-a500-4374-a90b-37b604a3ace0
Restart Required: No
Instructions:
1. Update to the latest version of binary-husky/gpt_academic. 2. Verify CSRF tokens are properly implemented on all file upload endpoints. 3. Test file upload functionality after update.
🔧 Temporary Workarounds
Implement CSRF Protection
allAdd CSRF tokens to all file upload forms and validate them server-side.
Restrict File Uploads
allDisable file upload functionality or restrict to trusted users only.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact.
- Use SameSite cookies and require re-authentication for sensitive actions.
🔍 How to Verify
Check if Vulnerable:
Check if running version 3.83 of binary-husky/gpt_academic and if file upload endpoints lack CSRF protection.Check Version:
Check package.json or version file in the gpt_academic installation directory.Verify Fix Applied:
Verify version is updated beyond 3.83 and test file upload endpoints for CSRF token validation.📡 Detection & Monitoring
Log Indicators:
- Unexpected file uploads from users
- Multiple failed upload attempts
- Uploads containing script tags or malicious content
Network Indicators:
- POST requests to upload endpoints without proper referrer headers or CSRF tokens
- File uploads from unexpected sources
SIEM Query:
source="web_logs" AND (uri_path="/upload" OR uri_path="/file_upload") AND (NOT csrf_token=*)