NextChat ChatGPT/Gemini UI Vulnerable to Server-Side Request Forgery

CVE-2024-38514

What is CVE-2024-38514?

NextChat, developed by ChatGPTNextWeb, contains a Server-Side Request Forgery (SSRF) vulnerability that arises from inadequate validation of the 'endpoint' GET parameter in the WebDav API endpoint. This flaw can be exploited to make arbitrary HTTPS requests from the vulnerable instance, enabling potential attackers to interact with the WebDav API using MKCOL, PUT, and GET methods. Furthermore, the SSRF vulnerability poses a risk to NextChat users, allowing attackers to execute arbitrary JavaScript code within users' browsers. The issue has been addressed in version 2.12.4, emphasizing the importance of updating to the latest version to mitigate security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References