Unauthorized Access to Sensitive Information in Chuanhuchatgpt

CVE-2024-2217

What is CVE-2024-2217?

ChuanhuChatGPT, developed by Gaizhenbiao, is susceptible to an improper access control vulnerability that compromises the integrity of the application by allowing unauthorized users to access the 'config.json' file. This vulnerability is present across both authenticated and unauthenticated versions of the application, enabling adversaries to retrieve sensitive data, including critical API keys such as 'openai_api_key', 'google_palm_api_key', and 'xmchat_api_key', along with configuration details and user credentials. The root cause of this issue lies in the inadequate handling of HTTP requests directed at the 'config.json' file, which fails to enforce proper access restrictions based on user authentication.

References