Path Traversal in gaizhenbiao/chuanhuchatgpt

The primary impact of CVE-2024-6255 is the ability for an attacker to delete arbitrary JSON files on the server hosting the chuanhuchatgpt application. This includes essential configuration files such as config.json and dsconfigchatbot.json. Successful exploitation can lead to a denial of service by removing critical configuration data, preventing the application from functioning correctly. Furthermore, an attacker could potentially manipulate settings by replacing configuration files with malicious versions, leading to further compromise. The blast radius extends to any system running an unpatched version of chuanhuchatgpt, making it a significant risk.

Organizations and individuals deploying chuanhuchatgpt, particularly those with publicly accessible instances or weak access controls, are at risk. Shared hosting environments where multiple users share the same server are especially vulnerable, as an attacker could potentially exploit this vulnerability to impact other users on the same server.

• python / server:

find /path/to/chuanhuchatgpt -name '*.json' -type f -mmin -60 # Check for recently modified JSON files

• generic web:

curl -I 'http://your-chuanhuchatgpt-server/../../../../etc/passwd' # Attempt directory traversal

1. 2024-07-31Disclosure

   disclosure

1. Reserviert2024-06-21
2. Veröffentlicht2024-07-31
3. Geändert2024-08-30
4. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-6255 is to upgrade to a patched version of chuanhuchatgpt as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds such as restricting file system access for the application user. Implement strict file permissions to prevent unauthorized modification or deletion of JSON files. Monitor system logs for suspicious file deletion attempts. While a WAF might not directly prevent this vulnerability, it can be configured to detect and block requests containing directory traversal sequences.