CVE-2024-12389
📋 TL;DR
A path traversal vulnerability in binary-husky/gpt_academic allows attackers to write arbitrary files outside the intended extraction directory when processing user-provided 7z archives. This can lead to remote code execution on affected systems. Users of gpt_academic version git 310122f are vulnerable.
💻 Affected Systems
- binary-husky/gpt_academic
📦 What is this software?
Gpt Academic by Binary Husky
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attacker to execute arbitrary commands, steal data, or deploy malware.
Likely Case
Arbitrary file write leading to web shell deployment, privilege escalation, or data exfiltration.
If Mitigated
Limited impact with proper file system permissions and sandboxing, potentially only file corruption or denial of service.
🎯 Exploit Status
Exploitation requires attacker to craft malicious 7z archive with path traversal payloads and have it processed by the vulnerable application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest git repository for fixes after commit 310122f
Vendor Advisory: https://huntr.com/bounties/37afb1c9-bba9-47ee-8617-a5f715271654
Restart Required: No
Instructions:
1. Update to latest version from git repository. 2. Verify py7zr package is updated. 3. Test 7z extraction functionality.
🔧 Temporary Workarounds
Disable 7z extraction
allTemporarily disable the vulnerable 7z file extraction feature until patched.
# Modify application configuration to disable 7z support
Implement input validation
allAdd path validation before extraction to ensure files stay within intended directory.
# Add path sanitization in extraction code
🧯 If You Can't Patch
- Implement strict file system permissions to limit write access
- Use containerization or sandboxing to isolate the application
🔍 How to Verify
Check if Vulnerable:
Check if using gpt_academic version git 310122f or earlier with 7z extraction enabled.Check Version:
git log --oneline -1Verify Fix Applied:
Test with crafted 7z archive containing path traversal payloads to ensure extraction fails or stays within intended directory.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- Failed extraction attempts with suspicious filenames
Network Indicators:
- Uploads of 7z archives to the application
SIEM Query:
source="application_logs" AND ("7z" OR "extract") AND (".." OR "path traversal")