CVE-2024-3404
📋 TL;DR
This vulnerability allows authenticated attackers to bypass access controls and read other users' chat history files in the gaizhenbiao/chuanhuchatgpt application. It affects users of version 20240121 who have authentication enabled. The flaw exposes sensitive conversation data to unauthorized access.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Attackers could systematically harvest all users' chat histories containing sensitive personal information, credentials, or confidential business discussions.
Likely Case
Authenticated users accessing other users' chat histories, potentially exposing personal conversations or sensitive information.
If Mitigated
With proper access controls, users can only access their own chat history, maintaining data confidentiality.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability details and fix are publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b
Vendor Advisory: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b
Restart Required: Yes
Instructions:
1. Pull the latest code from the repository. 2. Apply commit ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b. 3. Restart the application service.
🔧 Temporary Workarounds
Disable authentication
allRemove authentication entirely to eliminate the vulnerability vector, though this reduces overall security.
Modify configuration to disable user authentication
Restrict history directory access
linuxImplement filesystem-level permissions to restrict access to history directories.
chmod 700 history_directory_path
chown specific_user:group history_directory_path
🧯 If You Can't Patch
- Implement network segmentation to isolate the application from untrusted users.
- Monitor access logs for unusual patterns of history file access.
🔍 How to Verify
Check if Vulnerable:
Check if running version 20240121 and test authenticated access to other users' history files via API or direct file access.Check Version:
Check git commit history or application version fileVerify Fix Applied:
Verify the commit hash includes ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b and test that authenticated users cannot access others' history files.📡 Detection & Monitoring
Log Indicators:
- Multiple failed access attempts to history paths
- Successful access to history files from unexpected user accounts
Network Indicators:
- Unusual patterns of API calls to history endpoints from single authenticated users
SIEM Query:
source="application_logs" AND (path="*history*" AND user!="expected_user")