PT-2024-37333 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-07-11 · Updated 2024-07-15 · CVE-2024-6035

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240410

Description: A Stored Cross-Site Scripting (XSS) vulnerability exists, allowing an attacker to inject malicious JavaScript code into the chat history file. When a victim uploads this file, the malicious script is executed in the victim's browser, potentially leading to user data theft, session hijacking, malware distribution, and phishing attacks.

Recommendations: For gaizhenbiao/chuanhuchatgpt version 20240410, consider disabling the chat history file upload feature until a patch is available to prevent exploitation of the Stored Cross-Site Scripting (XSS) vulnerability. Restrict access to the chat history file to minimize the risk of malicious script execution. Avoid using the chat history file upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-6035

PYSEC-2024-61

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 10

• 🔥 https://huntr.com/bounties/e4e8da71-53a9-4540-8d70-6b670b076987 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6035 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6035 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-61 · Vendor Advisory
• https://t.me/cvedetector/654 · Telegram Post
• https://t.me/cvenotify/86098 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811378379356012837 · Twitter Post
• https://twitter.com/CVEnew/status/1811428045225390278 · Twitter Post
• https://t.me/cvenotify/86251 · Telegram Post
• https://t.me/cvenotify/85794 · Telegram Post