CVE-2024-12387 in gpt_academic
Summary
by MITRE • 03/20/2025
A vulnerability in the binary-husky/gpt_academic repository, as of commit git 3890467, allows an attacker to crash the server by uploading a specially crafted zip bomb. The server decompresses the uploaded file and attempts to load it into memory, which can lead to an out-of-memory crash. This issue arises due to improper input validation when handling compressed file uploads.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2025
The vulnerability identified as CVE-2024-12387 resides within the binary-husky/gpt_academic repository, specifically manifesting in the file handling mechanisms that process user-uploaded compressed archives. This repository serves as a platform for academic research and development activities, making it a potentially attractive target for adversaries seeking to disrupt operations. The flaw exists at the intersection of improper input validation and inadequate resource management, creating a pathway for denial-of-service attacks that can bring the entire system to a halt. The issue is particularly concerning given the repository's role in supporting artificial intelligence research where system stability directly impacts research productivity and data integrity.
The technical exploitation of this vulnerability centers on the server's failure to implement proper validation checks when processing compressed file uploads. When a malicious user uploads a crafted zip bomb, the system proceeds to decompress the archive without adequate safeguards against excessive resource consumption. The decompression process attempts to load all contents into memory simultaneously, creating a scenario where memory allocation requests exceed available system resources. This memory exhaustion occurs because the server does not implement size limits or resource monitoring during the decompression phase, allowing attackers to craft archives that appear benign but contain compressed data that expands to enormous sizes. The vulnerability directly maps to CWE-400, which addresses unchecked resource consumption, and CWE-770, covering allocation of resources without limits or throttling mechanisms.
The operational impact of this vulnerability extends beyond simple service disruption to potentially compromise the entire research infrastructure supported by the gpt_academic platform. An attacker could repeatedly upload zip bombs to cause sustained system crashes, leading to data loss, research delays, and potential compromise of sensitive academic information. The vulnerability affects systems where the repository is deployed for research purposes, particularly in academic institutions or research organizations that rely on AI development platforms. The crash scenario can result in complete system unavailability, forcing administrators to restart services and potentially lose unsaved work, with implications for collaborative research efforts and academic productivity. Organizations using this platform may face reputational damage and operational downtime that could extend for hours or days depending on the recovery process.
Mitigation strategies for CVE-2024-12387 should implement comprehensive input validation and resource management controls to prevent memory exhaustion attacks. The most effective approach involves establishing strict limits on decompressed file sizes and total memory consumption during the extraction process, with immediate termination of operations when thresholds are exceeded. Implementing proper resource monitoring and rate limiting mechanisms can prevent attackers from overwhelming the system through repeated attempts. Additionally, the platform should incorporate automatic file type detection and validation to ensure only known safe formats are processed, while also implementing proper logging and alerting systems to detect suspicious upload patterns. These controls align with ATT&CK technique T1499.004, which addresses network denial of service attacks, and should be complemented with regular security audits to ensure proper implementation of resource management policies. Organizations should also consider implementing sandboxing mechanisms for file processing to isolate potential malicious operations from the core system infrastructure.