PT-2024-34569 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Gaizhenbiao · Published 2024-06-06 · Updated 2024-11-04 · CVE-2024-5124

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version 20240310

Description A timing attack vulnerability exists in the password comparison logic of the gaizhenbiao/chuanhuchatgpt repository. The vulnerability arises from the use of the '=' operator in Python for password comparison, allowing an attacker to guess passwords based on the timing of each character's comparison. This can lead to the exposure of sensitive information to an unauthorized actor, potentially compromising the security of the system.

Recommendations For version 20240310, consider modifying the password comparison logic to use a secure method that is not vulnerable to timing attacks, such as using a constant-time comparison function. As a temporary workaround, consider implementing additional security measures to limit the number of login attempts and prevent brute-force attacks.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2024-5124

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 10

• 🔥 https://github.com/XiaomingX/cve-2024-5124-poc · Exploit
• 🔥 https://github.com/XiaomingX/CVE-2024-5124-poc · Exploit
• 🔥 https://huntr.com/bounties/e85ec077-930a-4597-975f-9341d2805641 · Exploit
• https://osv.dev/vulnerability/CVE-2024-5124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5124 · Security Note
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/e46ec4ecd896bc3c88eb9a2f44e8593f3c6761b4 · Note
• https://t.me/cvenotify/100484 · Telegram Post
• https://twitter.com/CVEnew/status/1798795449639313833 · Twitter Post
• https://t.me/cvenotify/98597 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1798815457392406604 · Twitter Post