CVE-2024-2217 — HIGH (7.5) — White Hats Nepal

Vulnerability Description

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication.

CVSS Score

7.5

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Gaizhenbiao	Chuanhuchatgpt	20240121

Related Weaknesses (CWE)

CWE-284

References

https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0aPatch
https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29ExploitThird Party Advisory
https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0aPatch
https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29ExploitThird Party Advisory

FAQ

What is CVE-2024-2217?

CVE-2024-2217 is a vulnerability with a CVSS score of 7.5 (HIGH). gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated ver...

How severe is CVE-2024-2217?

CVE-2024-2217 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-2217?

Check the references section above for vendor advisories and patch information. Affected products include: Gaizhenbiao Chuanhuchatgpt.