CVE-2024-7962
📋 TL;DR
An arbitrary file read vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628 allows attackers to read sensitive files on the server by exploiting insufficient validation of prompt template file paths. This affects systems running the vulnerable version of this ChatGPT web interface software, potentially exposing credentials, code, and logs.
💻 Affected Systems
- gaizhenbiao/chuanhuchatgpt
📦 What is this software?
Chuanhuchatgpt by Gaizhenbiao
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of sensitive server files including configuration files with database credentials, API keys, and user data leading to full system takeover.
Likely Case
Exfiltration of sensitive configuration files, source code, and log files containing authentication tokens and user information.
If Mitigated
Limited exposure of non-sensitive files due to proper file permissions and network segmentation.
🎯 Exploit Status
Exploit details are publicly available in the huntr.com bounty report; exploitation requires knowledge of target file paths but is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 2836fd1db3efcd5ede63c0e7fbbdf677730dbb51
Vendor Advisory: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/2836fd1db3efcd5ede63c0e7fbbdf677730dbb51
Restart Required: Yes
Instructions:
1. Pull latest code from GitHub repository. 2. Apply commit 2836fd1db3efcd5ede63c0e7fbbdf677730dbb51. 3. Restart the chuanhuchatgpt service.
🔧 Temporary Workarounds
Restrict file access permissions
linuxSet strict file permissions to limit what files the application can read
chmod 600 sensitive_files/*
chown root:root sensitive_files/*
Network isolation
allPlace the application behind a reverse proxy with strict access controls
🧯 If You Can't Patch
- Implement strict file system permissions to limit application access to only necessary directories
- Deploy network segmentation and WAF rules to block suspicious file path patterns in requests
🔍 How to Verify
Check if Vulnerable:
Check if running version 20240628 by examining the codebase or checking the commit hashCheck Version:
git log --oneline -1Verify Fix Applied:
Verify commit 2836fd1db3efcd5ede63c0e7fbbdf677730dbb51 is applied in the codebase📡 Detection & Monitoring
Log Indicators:
- Unusual file path patterns in application logs
- Multiple failed attempts to access non-template files
Network Indicators:
- HTTP requests containing absolute file paths in parameters
- Patterns of requests trying to access known sensitive file locations
SIEM Query:
source="application.log" AND ("../../" OR "/etc/" OR "/home/") AND status=200