CVE-2024-6255
📋 TL;DR
This vulnerability allows any user to delete any JSON file on the server through directory traversal attacks due to improper path validation. It affects gaizhenbiao/chuanhuchatgpt version 20240410, potentially leading to system disruption, configuration manipulation, or data loss.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Critical configuration files like config.json are deleted, causing complete system failure, data corruption, and potential privilege escalation if sensitive files are manipulated.
Likely Case
Attackers delete configuration files, disrupting chatbot functionality and requiring manual restoration from backups.
If Mitigated
With proper file permission controls and input validation, impact is limited to unauthorized file deletion attempts being blocked.
🎯 Exploit Status
Exploitation requires sending crafted requests to the JSON file handling endpoint with directory traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check for updates after 20240410
Vendor Advisory: https://huntr.com/bounties/48f3e370-6dcd-4f38-9350-d0419b3a7f82
Restart Required: Yes
Instructions:
1. Update to the latest version of gaizhenbiao/chuanhuchatgpt. 2. Verify the fix includes proper path validation. 3. Restart the application.
🔧 Temporary Workarounds
Restrict File Permissions
linuxSet strict file permissions on critical JSON files to prevent deletion.
chmod 600 config.json
chmod 600 ds_config_chatbot.json
Input Validation Filter
allImplement input validation to block directory traversal sequences in file paths.
🧯 If You Can't Patch
- Implement strict file system permissions to restrict write/delete access to critical files.
- Use a web application firewall (WAF) to block requests containing directory traversal patterns.
🔍 How to Verify
Check if Vulnerable:
Test if sending a request with '../' in the file path parameter allows deletion of files outside intended directory.Check Version:
Check the application version or repository commit history for 20240410.Verify Fix Applied:
Attempt the same directory traversal attack after patching; it should be blocked.📡 Detection & Monitoring
Log Indicators:
- Log entries showing file deletion attempts with '../' sequences
- Unexpected 404 errors for configuration files
Network Indicators:
- HTTP requests with file paths containing '../' patterns
SIEM Query:
source="web_logs" AND (uri="*../*" OR status=404 AND uri="*.json")