CVE-2024-6090
📋 TL;DR
A path traversal vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete other users' chat histories and any .json files on the system. This can cause denial of service by preventing user authentication. All users of the affected version are impacted.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical .json files, including configuration and authentication files, leading to permanent data loss and service disruption.
Likely Case
Unauthorized deletion of chat histories and potential authentication files, causing service disruption and data loss for users.
If Mitigated
Limited to deletion of non-critical .json files if proper file permissions and input validation are in place.
🎯 Exploit Status
Exploitation details are publicly available through the referenced commit and bounty reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 526c615c437377ee9c71f866fd0f19011910f705
Vendor Advisory: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/526c615c437377ee9c71f866fd0f19011910f705
Restart Required: Yes
Instructions:
1. Update to the latest version of chuanhuchatgpt. 2. Apply commit 526c615c437377ee9c71f866fd0f19011910f705. 3. Restart the application service.
🔧 Temporary Workarounds
Restrict file permissions
linuxSet strict file permissions on .json files to prevent deletion by the application user.
chmod 600 *.json
chown root:root *.json
Network isolation
linuxRestrict network access to the application to trusted IPs only.
iptables -A INPUT -p tcp --dport [APP_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [APP_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict input validation to reject path traversal sequences in user inputs.
- Monitor and alert on deletion of .json files in the application directory.
🔍 How to Verify
Check if Vulnerable:
Check if running version 20240410 of chuanhuchatgpt and test for path traversal by attempting to delete a test .json file using traversal sequences.Check Version:
Check the application version in the software interface or configuration files.Verify Fix Applied:
Verify the application version is updated past commit 526c615c and test that path traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events for .json files
- HTTP requests containing path traversal sequences like '../'
Network Indicators:
- HTTP requests to delete endpoints with suspicious parameters
SIEM Query:
source="application.log" AND ("delete" AND ".json") OR ("../" AND "delete")