PT-2024-37335 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Published 2024-07-10 · Updated 2025-07-15 · CVE-2024-6037

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240410

Description: A vulnerability allows an attacker to create arbitrary folders at any location on the server, including the root directory. This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.

Recommendations: For gaizhenbiao/chuanhuchatgpt version 20240410, consider restricting access to folder creation functionality to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability to create folders at arbitrary locations on the server. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2024-6037

Affected Products

Gaizhenbiao/Chuanhuchatgpt

References · 8

• 🔥 https://huntr.com/bounties/eca6904f-f9fd-40c8-9e85-96f54daf405e · Exploit
• https://osv.dev/vulnerability/CVE-2024-6037 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6037 · Security Note
• https://github.com/gaizhenbiao/chuanhuchatgpt/commit/71cb89c4c948dae5aaa0ae64b98f98e3965bdb37 · Note
• https://t.me/cvenotify/128985 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1811198160485650454 · Twitter Post
• https://twitter.com/CVEnew/status/1811322683738755578 · Twitter Post
• https://t.me/cvedetector/601 · Telegram Post