Platform
python
Component
gaizhenbiao/chuanhuchatgpt
Fixed in
20240305
CVE-2024-3234 represents a critical path traversal vulnerability affecting the chuanhuchatgpt application. This flaw allows unauthorized access to sensitive files, potentially exposing API keys and other configuration data. The vulnerability impacts versions of chuanhuchatgpt released prior to 20240305, and a fix was released on that date.
The primary impact of CVE-2024-3234 is the unauthorized disclosure of sensitive information. Due to the path traversal vulnerability, an attacker can bypass intended access restrictions within the web_assets directory. This enables them to read files outside of this directory, including config.json. This file likely contains API keys, which could then be used to compromise associated services or data. The blast radius extends to any systems or data accessible through the API keys stored in the config.json file. This vulnerability leverages a known issue (CVE-2023-51449) in an outdated gradio component, highlighting the importance of keeping dependencies up to date.
CVE-2024-3234 is based on CVE-2023-51449, a known path traversal vulnerability in gradio. Public proof-of-concept exploits for CVE-2023-51449 exist, increasing the likelihood of exploitation. The vulnerability was published on 2024-06-06. There is no indication of active exploitation campaigns at this time, but the ease of exploitation warrants immediate attention.
Exploit Status
EPSS
85.99% (99% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-3234 is to immediately upgrade chuanhuchatgpt to version 20240305 or later. This version incorporates the necessary fix to address the path traversal vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal attempts (e.g., ../ sequences). Carefully review and restrict file access permissions within the webassets directory to further limit the potential impact of this vulnerability. After upgrading, confirm the fix by attempting to access files outside the webassets directory and verifying that access is denied.
Update the chuanhuchatgpt application to version 20240305 or later. This version includes an update to the gradio component that fixes the path traversal vulnerability. This will prevent unauthorized access to sensitive files such as config.json.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-3234 is a critical path traversal vulnerability in chuanhuchatgpt versions before 20240305, allowing attackers to access sensitive files like config.json.
Yes, if you are using chuanhuchatgpt versions prior to 20240305, you are vulnerable to this path traversal attack.
Upgrade to version 20240305 or later to resolve the vulnerability. Consider WAF rules as a temporary mitigation.
While there's no confirmed active exploitation, the vulnerability is easily exploitable and based on a known issue, so immediate action is recommended.
Refer to the project's repository or release notes for the official advisory regarding CVE-2024-3234.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.