File Access Vulnerability in Gaizhenbiao's ChatGPT Product

CVE-2024-8143

What is CVE-2024-8143?

A vulnerability exists in the Gaizhenbiao ChuanhuChatGPT application, specifically in the /file endpoint, which could allow authenticated users to gain unauthorized access to the private chat histories of other users. Each user has their own directory within the history folder, named after their user name. However, through manipulation of the /file endpoint, it is possible for a user to enumerate and access files stored in the directories of other users. This exposure could potentially lead to serious privacy violations as users may be able to read sensitive chat histories that were intended to remain private.

References