CVE-2024-4321
📋 TL;DR
A Local File Inclusion vulnerability in gaizhenbiao/chuanhuchatgpt version 20240310 allows attackers to read arbitrary files on the server by manipulating the 'name' parameter during chat history upload. This can expose sensitive information like API keys and private data. Only users running the specific vulnerable version are affected.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive configuration files, credential theft, and potential privilege escalation.
Likely Case
Information disclosure of API keys, configuration files, and user data stored on the server.
If Mitigated
Limited impact with proper file permissions and input validation in place.
🎯 Exploit Status
Exploitation requires intercepting and modifying HTTP requests, but the vulnerability itself is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 20240310 (check repository for latest)
Vendor Advisory: https://huntr.com/bounties/19a16f8e-3d92-498f-abc9-8686005f067e
Restart Required: Yes
Instructions:
1. Update to the latest version from the official repository. 2. Restart the application. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to restrict file paths to allowed directories only.
Implement path traversal filters in the upload handler code
File Permission Restriction
linuxSet strict file permissions on sensitive directories to prevent unauthorized reads.
chmod 600 /path/to/sensitive/files
chown root:root /path/to/sensitive/files
🧯 If You Can't Patch
- Disable the chat history upload functionality entirely.
- Implement a web application firewall (WAF) with LFI protection rules.
🔍 How to Verify
Check if Vulnerable:
Test by attempting to read /etc/passwd or other known files via the chat history upload endpoint with a manipulated 'name' parameter.Check Version:
Check the application version in its configuration or via the interface if available.Verify Fix Applied:
Attempt the same exploitation test after patching; it should return an error or fail to read unauthorized files.📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in upload requests
- Multiple failed attempts to access sensitive files
Network Indicators:
- HTTP requests with path traversal sequences (../) in parameters
SIEM Query:
source="web_logs" AND (uri_path="*upload*" AND param_name="name" AND param_value="*../*")