CVE-2024-6036
📋 TL;DR
This vulnerability in gaizhenbiao/chuanhuchatgpt allows any user to restart the server by sending a specific request to the /queue/join? endpoint with fn_index:66. This can cause service disruption, data loss, and potential system compromise. Anyone running the affected version of this software is vulnerable.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage, data corruption, potential privilege escalation if restart triggers insecure startup, and system compromise.
Likely Case
Service disruption causing downtime, potential data loss from interrupted operations, and degraded user experience.
If Mitigated
Minimal impact with proper access controls, monitoring, and redundancy in place.
🎯 Exploit Status
Exploit is simple and requires no authentication, making it easy to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check for updates after 20240410
Vendor Advisory: https://huntr.com/bounties/e9eaaea9-5750-4955-9142-2f12ad4b06db
Restart Required: Yes
Instructions:
1. Update to the latest version of gaizhenbiao/chuanhuchatgpt.
2. Restart the server to apply the patch.
3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allUse a web application firewall or reverse proxy to block requests to /queue/join? with fn_index:66.
# Example for nginx: location ~ ^/queue/join\?.*fn_index=66 { deny all; }
Restrict Network Access
linuxLimit access to the server to trusted IPs only.
# Example iptables rule: iptables -A INPUT -p tcp --dport <port> -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <port> -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the server from untrusted networks.
- Deploy monitoring and alerting for unauthorized restart attempts.
🔍 How to Verify
Check if Vulnerable:
Send a request to http://<server>/queue/join? with parameter fn_index=66 and observe if server restarts.Check Version:
Check the software version in the application interface or configuration files.Verify Fix Applied:
After patching, repeat the vulnerable request and confirm the server does not restart.📡 Detection & Monitoring
Log Indicators:
- Log entries showing server restarts, especially from /queue/join requests with fn_index:66.
Network Indicators:
- HTTP requests to /queue/join? with fn_index=66 parameter.
SIEM Query:
source="web_logs" AND uri="/queue/join" AND query_string="*fn_index=66*"