gaizhenbiao ChuanhuChatGPT up to 20240628 Private Chat data access operations outside of expected data manager component

Summaryinfo

A vulnerability labeled as problematic has been found in gaizhenbiao ChuanhuChatGPT up to 20240628. This issue affects some unknown processing of the component Private Chat Handler. Executing a manipulation can lead to data access operations outside of expected data manager component. This vulnerability appears as CVE-2024-8143. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in gaizhenbiao ChuanhuChatGPT up to 20240628. It has been declared as problematic. This vulnerability affects an unknown part of the component Private Chat Handler. The manipulation with an unknown input leads to a data access operations outside of expected data manager component vulnerability. The CWE definition for the vulnerability is CWE-1057. The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager. As an impact it is known to affect confidentiality. CVE summarizes:

In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to private chat histories. This vulnerability can be exploited to read any user's private chat history.

The advisory is available at huntr.com. This vulnerability was named CVE-2024-8143 since 08/24/2024. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 20240919 eliminates this vulnerability. Applying the patch ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• gaizhenbiao

Name

• ChuanhuChatGPT

Version

• 20240628

License

• open-source

Website

• Product: https://github.com/gaizhenbiao/chuanhuchatgpt/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion