Arbitrary File Path Injection Vulnerability in Chat History Upload

CVE-2024-4321

Summary

A Local File Inclusion (LFI) vulnerability has been identified in the Gaizhenbiao Chuanhu ChatGPT application, particularly in the chat history upload feature. This flaw is due to inadequate input validation surrounding file path management. An attacker can exploit this security gap by intercepting upload requests and altering the 'name' parameter, which may allow them to gain access to arbitrary files on the server. Such unauthorized access can lead to the exposure of sensitive information, such as API keys and private user data. The vulnerability affects version 20240310 of the application, emphasizing the necessity for prompt remediation to safeguard sensitive data from unauthorized disclosure.

References