CVE-2024-2217
Improper Access Control in gaizhenbiao/chuanhuchatgpt
Summary
Improper Access Control in gaizhenbiao/chuanhuchatgpt
Original description
The description as published by the source.
gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (openai_api_key, google_palm_api_key, xmchat_api_key, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the config.json file, which does not properly restrict access based on user authentication.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com