CVE-2024-2217
Improper Access Control in gaizhenbiao/chuanhuchatgpt
Résumé
Improper Access Control in gaizhenbiao/chuanhuchatgpt
Description d'origine
La description telle que publiée par la source (souvent en anglais).
gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (openai_api_key, google_palm_api_key, xmchat_api_key, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the config.json file, which does not properly restrict access based on user authentication.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com