CVE-2024-10714

Executive Summary

CVE-2024-10714 is a high-severity Denial of Service (DoS) vulnerability affecting binary-husky/gpt_academic version 3.83. The flaw resides in the multipart boundary parsing logic during file upload. An unauthenticated attacker can send a crafted multipart request with an excessive number of characters appended to the boundary string. This forces the server to enter an infinite processing loop, consuming CPU resources and rendering the application inaccessible. The vulnerability is triggered when the server logs the warning: multipart.multipart Consuming a byte '0x2d' in end state. No patch is currently available, and no public exploit code exists.

Supply Chain & Package Security

This vulnerability affects a Python-based open-source project (gpt_academic) distributed via GitHub. The project is not published on PyPI, but users may install it directly from the repository. The lack of a patch and the nature of the flaw (resource exhaustion) make it a supply chain risk for any organization using this tool for academic or research purposes.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is easily exploitable remotely without authentication, making it a significant threat to availability.

Deep Dive & Mechanics

The vulnerability is located in the multipart form-data parsing logic of gpt_academic. When a file upload is initiated, the server expects a multipart boundary string to delimit parts of the request. By appending an excessive number of characters (specifically bytes like 0x2d, which is the hyphen character) to the boundary, the parser enters an unexpected state. The server then attempts to consume each character individually, logging a warning for each byte. This process is CPU-intensive and does not terminate, effectively causing a DoS.

The core issue is a lack of input validation on the boundary length and content. The parser does not enforce a maximum boundary size or handle malformed boundaries gracefully, leading to an infinite loop.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.83): The vulnerable code is in the multipart parsing module. The parser does not check the length of the boundary string before processing. When a boundary with excessive characters is received, the parser enters a state where it consumes bytes one by one without progressing.

# Vulnerable snippet (conceptual)
def parse_multipart(stream, boundary):
    while True:
        byte = stream.read(1)
        if byte == b'':
            break
        # No length check on boundary
        if byte in boundary:
            # Process boundary
            pass
        else:
            # Log warning and continue
            log.warning(f"Consuming a byte '{byte}' in end state")

Patched Code (hypothetical): A patch would enforce a maximum boundary length and add a timeout or counter to break out of the loop.

# Patched snippet (conceptual)
MAX_BOUNDARY_LENGTH = 1024
def parse_multipart(stream, boundary):
    if len(boundary) > MAX_BOUNDARY_LENGTH:
        raise ValueError("Boundary too long")
    # ... rest of parsing with timeout

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running gpt_academic version 3.83 with file upload functionality exposed.
• Network access to the target.

Exploit Steps:

1. Craft a multipart form-data request with a boundary string containing thousands of characters (e.g., ----WebKitFormBoundary repeated).
2. Send the request to the file upload endpoint.
3. The server will enter an infinite loop, consuming CPU and becoming unresponsive.

Example Request (using curl):

#!/bin/bash
# Craft a malicious boundary
BOUNDARY=$(python3 -c "print('-'*10000)")
curl -X POST http://target/upload \
  -H "Content-Type: multipart/form-data; boundary=$BOUNDARY" \
  --data-binary @/dev/null

Blue Team

Detection:

• Monitor for excessive CPU usage on the gpt_academic server.
• Look for repeated log entries containing multipart.multipart Consuming a byte '0x2d' in end state.
• Use network monitoring to detect multipart requests with abnormally long boundary strings.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block requests with boundary strings exceeding a certain length (e.g., 1024 characters).
• Apply rate limiting to file upload endpoints.
• Restrict access to the file upload functionality to authenticated users only.

Indicators of Compromise (IOCs)

• Log Entries: Repeated occurrences of multipart.multipart Consuming a byte '0x2d' in end state in server logs.
• Network Traffic: HTTP POST requests to /upload (or similar) with a Content-Type header containing a boundary string longer than 1024 characters.
• System Impact: High CPU usage on the server running gpt_academic, potentially leading to unresponsiveness.

Detection Engineering

YARA Rule

rule CVE_2024_10714_Multipart_DoS {
    meta:
        description = "Detects malicious multipart requests targeting CVE-2024-10714"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10714"
    strings:
        $boundary = /multipart\/form-data; boundary=[\-]{1025,}/
        $log_warning = "multipart.multipart Consuming a byte '0x2d' in end state"
    condition:
        $boundary or $log_warning
}

Sigma Rule

title: CVE-2024-10714 DoS via Multipart Boundary
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects excessive multipart boundary length in HTTP requests
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs-content-type|contains: 'multipart/form-data'
        cs-content-type|re: 'boundary=[\-]{1025,}'
    condition: selection
falsepositives:
    - Legitimate large uploads (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10714 DoS via Multipart Boundary"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"multipart/form-data"; http_header; pcre:"/boundary=[\-]{1025,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not required.
2. Implement a WAF rule to block requests with boundary strings longer than 1024 characters.
3. Apply rate limiting to the upload endpoint.

Long-term Fix:

• Monitor the official gpt_academic repository for a patch.
• Apply the patch once available, or manually modify the multipart parsing code to enforce a maximum boundary length and add a timeout.

Workaround:

• Restrict access to the upload endpoint via IP whitelisting or authentication.

Valters IT