PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-04-10 · Updated 2025-07-29 · CVE-2024-2217

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt (affected versions not specified)

Description The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (openai api key, google palm api key, xmchat api key, etc.), configuration details, and user credentials. The problem stems from the application's handling of HTTP requests for the config.json file, which does not properly restrict access based on user authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-2217

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 7

• 🔥 https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29 · Exploit
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-2217 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2217 · Vendor Advisory
• https://twitter.com/CVEnew/status/1778118888309342449 · Twitter Post
• https://t.me/cvenotify/76313 · Telegram Post
• https://t.me/cveNotify/130175 · Telegram Post