Vulnerability · Published Jun 28, 2024 · Assigned by GitHub_M

CVE-2024-38514NextChat Server-Side Request Forgery (SSRF)

High 7.4

In plain English

A high-severity server-side request forgery in ChatGPT-Next-Web from ChatGPTNextWeb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)2.2%top 17.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.

Affected products (as reported)

Vendor	Product	Versions
ChatGPTNextWeb	ChatGPT-Next-Web	< 2.12.4

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/security/advisories/GHSA-gph5-rx77-3pjg x_refsource_CONFIRM
https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/commit/dad122199a85c2f12277593973e1784b212adf5e x_refsource_MISC