NextChat Vulnerability Affects ChatGPT-Next-Web, Server-Side Request Forgery and Cross-Site Scripting Attacks Possible
CVE-2023-49785

9.8CRITICAL

Key Information:

Vendor: Chatgptnextweb
Status: Nextchat
Vendor: CVE Published:; 12 March 2024

🔔 Create Chatgptnextweb Vulnerability Alert

Badges

📈 Trended📈 Score: 4,610🟣 EPSS 92%📰 News Worthy

What is CVE-2023-49785?

CVE-2023-49785 is a vulnerability affecting NextChat, also known as ChatGPT-Next-Web, which is a cross-platform interface designed for interaction with the ChatGPT AI model. This vulnerability allows attackers to perform server-side request forgery (SSRF) and cross-site scripting (XSS) attacks, potentially leading to unauthorized access to internal systems and data manipulation. Organizations utilizing this product could face significant security threats, including data breaches and unauthorized actions taken within their internal networks.

Technical Details

The flaw exists in versions 2.11.2 and earlier of NextChat, where the vulnerability can be exploited through both read and write access to internal HTTP endpoints. Attackers could leverage HTTP methods like POST and PUT to manipulate data or to proxy traffic from their source IP, masking their identity while targeting other internet resources. As of the latest reports, no official patch has been released to address this vulnerability, and users are advised to take alternative measures to secure their applications.

Impact of the Vulnerability

Internal Data Exposure: The vulnerability facilitates unauthorized access to sensitive internal HTTP endpoints, which could lead to the leakage of confidential organizational data.
Data Manipulation Risks: With write access enabled, attackers can perform unauthorized actions on the system, which may severely disrupt operations and affect the integrity of data.
Proxy for Malicious Activities: By masking their actual source IPs, attackers can use the affected system to conduct further malicious activities against other targets, complicating incident response and attribution efforts for organizations.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch