File Exposure Vulnerability in Binary-Husky GPT Academic Plugin

CVE-2024-10948

What is CVE-2024-10948?

A security issue in the upload function of Binary-Husky's gpt_academic enables any user to read arbitrary files on the system, including sensitive files like config.py. By intercepting a websocket request during a file upload, an attacker can manipulate the file path to access files they shouldn't be able to. The server facilitates this exploitation by copying the file to a designated folder and exposing the copied file path through a GET request. This flaw poses a significant risk, as it can lead to unauthorized access to sensitive system files, potentially revealing credentials and critical configuration data.

References