Vulnerability · Published Oct 29, 2024 · Assigned by @huntr_ai
CVE-2024-8143Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgpt
Medium 6.5
In plain English
A medium-severity security flaw in gaizhenbiao/chuanhuchatgpt from gaizhenbiao. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Official description
In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to private chat histories. This vulnerability can be exploited to read any user's private chat history.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | chuanhuchatgpt | no fix listed | PYSEC-2024-113 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gaizhenbiao | gaizhenbiao/chuanhuchatgpt | unspecified – before 20240919 |
Weakness: CWE-1057 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N