PT-2023-8836 · Nextchat · Nextchat

Secatgourity · Published 2023-11-25 · Updated 2024-12-04 · CVE-2023-49785

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NextChat versions 2.11.2 and prior

Description The issue concerns a server-side request forgery and cross-site scripting vulnerability in NextChat, also known as ChatGPT-Next-Web. This vulnerability enables read access to internal HTTP endpoints and write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. Approximately 29,217 devices are potentially affected, mainly distributed in the United States and China. There are no reported patches available at this time.

Recommendations For versions 2.11.2 and prior, as a temporary workaround, consider avoiding exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

BDU:2024-02148

CVE-2023-49785

GHSA-QF3Q-9F3H-CJP9

Affected Products

Nextchat

References · 32

• 🔥 https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/4283 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49785.json · Exploit
• 🔥 https://vicarius.io/vsociety/posts/hacking-ai-chatbots-for-fun-and-learning-analyzing-an-unauthenticated-ssrf-and-reflected-xss-in-chatgpt-next-web-cve-2023-49785 · Exploit
• 🔥 https://horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to · Exploit
• https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/pull/4285 · Patch
• https://osv.dev/vulnerability/GHSA-qf3q-9f3h-cjp9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49785 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02148 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-49785 · Security Note
• https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web · Note
• https://t.me/true_secator/5515 · Telegram Post
• https://twitter.com/zoomeye_team/status/1767483386690675041 · Twitter Post
• https://twitter.com/ksg93rd/status/1768309466515005479 · Twitter Post
• https://twitter.com/payloadartist/status/1767543566228914559 · Twitter Post
• https://twitter.com/DhiyaneshDK/status/1767212195727728793 · Twitter Post