PT-2025-12304 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Publicado 2025-03-20 · Atualizado 2025-03-21 · CVE-2025-0188

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240914

Description A Server-Side Request Forgery (SSRF) issue was discovered, allowing an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the response directly, potentially leading to unauthorized access to internal systems, data theft, service disruption, or further attacks such as port scanning and accessing metadata endpoints.

Recommendations For gaizhenbiao/chuanhuchatgpt version 20240914, consider restricting access to the response folder to minimize the risk of exploitation. As a temporary workaround, avoid using the SHA-1 hash of the target URL as a folder name until a patch is available. Restrict access to metadata endpoints to prevent further attacks.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2025-0188

PYSEC-2025-98

Produtos afetados

Gaizhenbiao/Chuanhuchatgpt

Referências · 6

• 🔥 https://huntr.com/bounties/879d2470-eca5-49c0-b3d1-57469cfff412 · Exploit
• https://osv.dev/vulnerability/PYSEC-2025-98 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1903036513085997406 · Publicação no Twitter
• https://t.me/cvetracker/19509 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-0188 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-0188 · Nota de Segurança