CVE-2024-2217
Improper Access Control in gaizhenbiao/chuanhuchatgpt
概要
Improper Access Control in gaizhenbiao/chuanhuchatgpt
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (openai_api_key, google_palm_api_key, xmchat_api_key, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the config.json file, which does not properly restrict access based on user authentication.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com