PT-2024-37184 · Unknown · Chuanhuchatgpt

Published 2024-06-27 · Updated 2024-06-27 · CVE-2024-5822

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip

Description: A Server-Side Request Forgery (SSRF) issue exists in the upload processing interface, allowing attackers to send crafted requests from the vulnerable server to internal or external resources. This could potentially bypass security controls and access sensitive data.

Recommendations: For versions <= ChuanhuChatGPT-20240410-git.zip, as a temporary workaround, consider restricting access to the upload processing interface until a patch is available. Avoid using the vulnerable interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-5822

PYSEC-2024-268

Affected Products

Chuanhuchatgpt

References · 4

• 🔥 https://huntr.com/bounties/b24f1b5f-a529-435b-ac4d-5ca71d5d1fb5 · Exploit
• https://osv.dev/vulnerability/CVE-2024-5822 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5822 · Security Note
• https://osv.dev/vulnerability/PYSEC-2024-268 · Vendor Advisory