Server-Side Request Forgery Vulnerability in Binary-Husky GPT Academic

CVE-2024-12392

What is CVE-2024-12392?

A Server-Side Request Forgery (SSRF) vulnerability exists in Binary-Husky's gpt_academic which allows attackers to exploit incomplete URL validation. This flaw enables malicious users to make the application access arbitrary URLs, including internal services. By doing so, they can retrieve sensitive data that is only accessible from the server, such as AWS metadata credentials. This vulnerability poses a significant risk as it could allow local exploits to escalate into broader network-based attacks. It is crucial for users of gpt_academic to apply necessary patches and review their security practices to mitigate potential exploitation.

References