CVE-2024-5982

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5982", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-06-13T18:09:56.490Z", "datePublished": "2024-10-29T12:46:24.726Z", "dateUpdated": "2024-10-29T13:47:03.458Z"}, "containers": {"cna": {"title": "Path Traversal in gaizhenbiao/chuanhuchatgpt", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-10-29T12:46:24.726Z"}, "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads, potentially leading to remote code execution (RCE). The get_history_names function in utils.py permits arbitrary directory creation. Additionally, the load_template function in utils.py can be exploited to leak the first column of CSV files. These issues stem from improper sanitization of user inputs concatenated with directory paths using os.path.join."}], "affected": [{"vendor": "gaizhenbiao", "product": "gaizhenbiao/chuanhuchatgpt", "versions": [{"version": "unspecified", "lessThan": "20240918", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/5d5c5356-e893-44d1-b5ca-642aa05d96bb"}, {"url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/952fc8c3cbacead858311747cddd4bedcb4721d7"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22"}]}], "source": {"advisory": "5d5c5356-e893-44d1-b5ca-642aa05d96bb", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "gaizhenbiao", "product": "gaizhenbiao\\/chuanhuchatgpt", "cpes": ["cpe:2.3:a:gaizhenbiao:gaizhenbiao\\/chuanhuchatgpt:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "20240918", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-29T13:44:27.936584Z", "id": "CVE-2024-5982", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T13:47:03.458Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-5982", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-29T13:44:27.936584Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:gaizhenbiao:gaizhenbiao\\/chuanhuchatgpt:*:*:*:*:*:*:*:*"], "vendor": "gaizhenbiao", "product": "gaizhenbiao\\/chuanhuchatgpt", "versions": [{"status": "affected", "version": "0", "lessThan": "20240918", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T13:46:47.949Z"}}], "cna": {"title": "Path Traversal in gaizhenbiao/chuanhuchatgpt", "source": {"advisory": "5d5c5356-e893-44d1-b5ca-642aa05d96bb", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gaizhenbiao", "product": "gaizhenbiao/chuanhuchatgpt", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "20240918", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/5d5c5356-e893-44d1-b5ca-642aa05d96bb"}, {"url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/952fc8c3cbacead858311747cddd4bedcb4721d7"}], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads, potentially leading to remote code execution (RCE). The get_history_names function in utils.py permits arbitrary directory creation. Additionally, the load_template function in utils.py can be exploited to leak the first column of CSV files. These issues stem from improper sanitization of user inputs concatenated with directory paths using os.path.join."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-10-29T12:46:24.726Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5982", "state": "PUBLISHED", "dateUpdated": "2024-10-29T13:47:03.458Z", "dateReserved": "2024-06-13T18:09:56.490Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-10-29T12:46:24.726Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "gaizhenbiao/chuanhuchatgpt", "vendor": "gaizhenbiao", "versions": [{"lessThan": "20240918", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}, {"affectedData": [{"cpes": ["cpe:2.3:a:gaizhenbiao:gaizhenbiao\\/chuanhuchatgpt:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "gaizhenbiao\\/chuanhuchatgpt", "vendor": "gaizhenbiao", "versions": [{"lessThan": "20240918", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:*:*:*:*:*:*:*:*", "matchCriteriaId": "B223170E-958F-48BE-9626-60F2099964FF", "versionEndExcluding": "20240918", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A path traversal vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability arises from unsanitized input handling in multiple features, including user upload, directory creation, and template loading. Specifically, the load_chat_history function in modules/models/base_model.py allows arbitrary file uploads, potentially leading to remote code execution (RCE). The get_history_names function in utils.py permits arbitrary directory creation. Additionally, the load_template function in utils.py can be exploited to leak the first column of CSV files. These issues stem from improper sanitization of user inputs concatenated with directory paths using os.path.join."}, {"lang": "es", "value": "Existe una vulnerabilidad de path traversal en la \u00faltima versi\u00f3n de gaizhenbiao/chuanhuchatgpt. La vulnerabilidad surge del manejo de entrada no desinfectado en m\u00faltiples funciones, incluyendo la carga de usuarios, la creaci\u00f3n de directorios y la carga de plantillas. Espec\u00edficamente, la funci\u00f3n load_chat_history en modules/models/base_model.py permite cargas de archivos arbitrarias, lo que puede llevar a la ejecuci\u00f3n de c\u00f3digo remoto (RCE). La funci\u00f3n get_history_names en utils.py permite la creaci\u00f3n de directorios arbitrarios. Adem\u00e1s, la funci\u00f3n load_template en utils.py puede ser explotada para filtrar la primera columna de archivos CSV. Estos problemas surgen de la sanitizaci\u00f3n incorrecta de las entradas de usuario concatenadas con rutas de directorio usando os.path.join."}], "id": "CVE-2024-5982", "lastModified": "2026-06-17T08:17:02.023", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security@huntr.dev", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-5982", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-29T13:44:27.936584Z", "version": "2.0.3"}}]}, "published": "2024-10-29T13:15:07.637", "references": [{"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/952fc8c3cbacead858311747cddd4bedcb4721d7"}, {"source": "security@huntr.dev", "tags": ["Exploit"], "url": "https://huntr.com/bounties/5d5c5356-e893-44d1-b5ca-642aa05d96bb"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{}

{}