CVE-2024-12387
📋 TL;DR
This vulnerability allows attackers to crash servers running the binary-husky/gpt_academic repository by uploading specially crafted zip bombs. When the server decompresses these malicious files, it attempts to load them into memory, causing out-of-memory crashes. Anyone using the affected version of this software is vulnerable.
💻 Affected Systems
- binary-husky/gpt_academic
📦 What is this software?
Gpt Academic by Binary Husky
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash leading to denial of service, potentially disrupting all services running on the affected system.
Likely Case
Temporary service disruption and server crashes requiring manual intervention to restart services.
If Mitigated
Minimal impact with proper input validation and resource limits in place.
🎯 Exploit Status
Exploitation requires only the ability to upload files to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit git 3890467
Vendor Advisory: https://huntr.com/bounties/02b4ab21-d29b-4cd7-ad80-f83081ce82a4
Restart Required: Yes
Instructions:
1. Update to the latest version of binary-husky/gpt_academic repository. 2. Pull the latest changes from the repository. 3. Restart the application server.
🔧 Temporary Workarounds
Implement file upload restrictions
allAdd server-side validation to limit file size and type before decompression
# Add validation in your file upload handler to check file size and extension
Set resource limits
linuxConfigure memory limits for decompression processes
# Set ulimit for memory usage in Linux: ulimit -v [memory_limit_in_kb]
🧯 If You Can't Patch
- Disable file upload functionality entirely if not required
- Implement WAF rules to block suspicious compressed file uploads
🔍 How to Verify
Check if Vulnerable:
Check if your version is at or before commit git 3890467 by examining your git history or version information.Check Version:
git log --oneline -1Verify Fix Applied:
Verify you have updated to a version after commit git 3890467 and test file upload functionality with safe compressed files.📡 Detection & Monitoring
Log Indicators:
- Large memory usage spikes
- Server crash/restart logs
- Failed decompression attempts
Network Indicators:
- Multiple large compressed file uploads to vulnerable endpoints
SIEM Query:
source="application.logs" AND ("out of memory" OR "crash" OR "decompression failed") AND "file upload"