In short
- CVE-2024-2217 is a HIGH (CVSS 7.5) vulnerability affecting chuanhuchatgpt, chuanhuchatgpt (gaizhenbiao).
- Chance of exploitation in the next 30 days (EPSS): 0.78%, higher than 56.1% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
Description
gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (openai_api_key, google_palm_api_key, xmchat_api_key, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the config.json file, which does not properly restrict access based on user authentication.
NVD description
gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication.
More vulnerabilities in chuanhuchatgpt
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free