EmailGPT up to eecfaf2cff58793549dd0c1266ac1d62e0c8811d API Service injection

Summaryinfo

A vulnerability described as problematic has been identified in EmailGPT up to eecfaf2cff58793549dd0c1266ac1d62e0c8811d. Affected by this issue is some unknown functionality of the component API Service. Executing a manipulation can lead to injection. This vulnerability is tracked as CVE-2024-5184. The attack is only possible within the local network. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in EmailGPT up to eecfaf2cff58793549dd0c1266ac1d62e0c8811d. This vulnerability affects an unknown code block of the component API Service. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality. CVE summarizes:

The EmailGPT service contains a prompt injection vulnerability. The service uses an API service that allows a malicious user to inject a direct prompt and take over the service logic. Attackers can exploit the issue by forcing the AI service to leak the standard hard-coded system prompts and/or execute unwanted prompts. When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service.

The weakness was disclosed by Mohammed Alshehri. The advisory is available at synopsys.com. This vulnerability was named CVE-2024-5184 since 05/21/2024. The exploitation appears to be easy. Access to the local network is required for this attack. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1055 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• EmailGPT

Version

• eecfaf2cff58793549dd0c1266ac1d62e0c8811d

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion