PT-2024-30372 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-05-16 · Updated 2025-07-10 · CVE-2024-4321

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240310

Description A Local File Inclusion (LFI) issue exists in the application, specifically within the chat history upload functionality, due to improper input validation when handling file paths. This allows an attacker to exploit the issue by manipulating the name parameter to specify arbitrary file paths, leading to information leakage, including API keys and private information.

Recommendations For version 20240310, as a temporary workaround, consider restricting access to the chat history upload functionality until a patch is available. Avoid using the name parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-4321

PYSEC-2024-267

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 6

• 🔥 https://huntr.com/bounties/19a16f8e-3d92-498f-abc9-8686005f067e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-4321 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-267 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4321 · Vendor Advisory
• https://t.me/cvenotify/128371 · Telegram Post
• https://twitter.com/staatsgeheim/status/1837140837840363955 · Twitter Post