CVE-2024-12389

Executive Summary

CVE-2024-12389 is a critical path traversal vulnerability in the binary-husky/gpt_academic project, specifically in commit 310122f. The application allows users to upload and extract 7z archives without proper validation of file paths. The underlying Python library py7zr does not guarantee that extracted files remain within the intended extraction directory. An attacker can craft a malicious 7z archive containing files with path traversal sequences (e.g., ../../malicious.py) to write arbitrary files to the filesystem. This can lead to remote code execution (RCE) by overwriting critical system files, configuration files, or injecting malicious code into the application's runtime environment.

The vulnerability has a CVSS score of 8.8 (High) and is currently unpatched. No public proof-of-concept (PoC) or exploit code has been released, but the attack vector is well-understood and can be weaponized with minimal effort.

Supply Chain & Package Security

This vulnerability is specific to the gpt_academic Python application and its use of the py7zr library. The py7zr library itself is not inherently vulnerable; rather, the application fails to sanitize or validate the paths of files extracted from user-supplied 7z archives. This is a classic case of insecure deserialization or untrusted archive extraction. Organizations using gpt_academic should immediately assess their exposure and consider disabling the 7z extraction feature until a patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required; a malicious archive is sufficient.
• Privileges Required (PR): None (N) – No authentication is needed to upload the archive.
• User Interaction (UI): Required (R) – A user must upload and trigger extraction of the malicious archive.
• Scope (S): Unchanged (U) – The exploit does not change the security scope.
• Confidentiality (C): High (H) – Arbitrary file write can lead to data exfiltration.
• Integrity (I): High (H) – Overwriting files can compromise system integrity.
• Availability (A): High (H) – RCE can lead to denial of service or system takeover.

Threat Level: Critical. The combination of network exploitability, low complexity, and high impact makes this a high-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability resides in the archive extraction functionality of gpt_academic. The application accepts user-uploaded 7z files and uses the py7zr library to extract them. The py7zr library, by design, does not perform path sanitization; it trusts the paths stored within the archive. An attacker can create a 7z archive containing files with path traversal sequences (e.g., ../../etc/cron.d/malicious or ../../app/config.py). When extracted, these files are written to arbitrary locations on the filesystem, potentially overwriting critical system or application files.

The attack flow:

1. Attacker crafts a 7z archive with a file entry named ../../tmp/evil.sh.
2. The archive is uploaded to gpt_academic via the file upload feature.
3. The application calls py7zr.extractall() or similar, which writes evil.sh to /tmp/evil.sh.
4. If the attacker can also write to a location that triggers execution (e.g., a cron job, a web-accessible directory, or a Python import path), they achieve RCE.

The vulnerability is exacerbated by the lack of input validation and the absence of a sandbox or chroot for extraction.

Vulnerable vs. Patched Code

Vulnerable Code (commit 310122f):

import py7zr

def extract_archive(file_path, extract_dir):
    with py7zr.SevenZipFile(file_path, mode='r') as z:
        z.extractall(path=extract_dir)

This code does not validate that extracted files remain within extract_dir.

Patched Code (hypothetical):

import py7zr
import os

def extract_archive_safe(file_path, extract_dir):
    extract_dir = os.path.abspath(extract_dir)
    with py7zr.SevenZipFile(file_path, mode='r') as z:
        for entry in z.getnames():
            # Resolve the full path and check it stays within extract_dir
            full_path = os.path.abspath(os.path.join(extract_dir, entry))
            if not full_path.startswith(extract_dir + os.sep):
                raise ValueError(f"Path traversal detected: {entry}")
        z.extractall(path=extract_dir)

The patched code iterates over archive entries, resolves their absolute paths, and rejects any entry that attempts to escape the extraction directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

• Target: gpt_academic running on a Linux server (e.g., Ubuntu 22.04) with Python 3.10+.
• Attacker machine: Kali Linux or any system with Python and py7zr installed.

Exploitation Steps:

1. Create a malicious 7z archive:

   # Create a file that will be written to /tmp/evil.sh
   echo '#!/bin/bash' > evil.sh
   echo 'echo "PWNED" > /tmp/pwned.txt' >> evil.sh
   chmod +x evil.sh
   
   # Create a 7z archive with path traversal
   # Using Python to craft the archive with a malicious entry name
   python3 -c "
   import py7zr
   archive = py7zr.SevenZipFile('malicious.7z', 'w')
   archive.write('evil.sh', '../../tmp/evil.sh')
   archive.close()
   "
   

2. Upload malicious.7z to the gpt_academic file upload endpoint.
3. Trigger extraction (e.g., via the "Extract Archive" button).
4. Verify execution: The file /tmp/evil.sh is written. If the attacker can also trigger execution (e.g., via a cron job or by overwriting a Python module), RCE is achieved.

Advanced Exploitation:

• Overwrite a Python module in the application's site-packages to inject code on next import.
• Overwrite ~/.ssh/authorized_keys for persistent SSH access.
• Overwrite a web template file to serve malicious content.

Blue Team (Defense & Detection)

Defense Measures:

• Disable the 7z extraction feature until a patch is applied.
• Implement strict input validation: reject archives containing path traversal sequences.
• Use a sandboxed extraction environment (e.g., Docker container with read-only filesystem).
• Monitor file system events for unexpected writes to sensitive directories.

Detection:

• Monitor for file writes to directories outside the intended extraction path.
• Alert on creation of files in /tmp, /etc, /var/www, or other sensitive locations.
• Use file integrity monitoring (FIM) to detect unauthorized changes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.7z: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, replace with actual)
  • evil.sh: a1b2c3d4e5f6... (example)
• Network Indicators:
  • Outbound connections from the server to attacker-controlled IPs (if RCE is achieved).
• File System Indicators:
  • Unexpected files in /tmp, /etc, /var/www, or application directories.
  • Modified Python modules or configuration files.
• Process Indicators:
  • Unusual processes spawned by the web server user (e.g., bash, python, nc).

Detection Engineering

YARA Rule

rule CVE_2024_12389_Path_Traversal_7z {
    meta:
        description = "Detects malicious 7z archives with path traversal sequences"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12389"
    strings:
        $traversal1 = "../../" ascii wide nocase
        $traversal2 = "..\\..\\" ascii wide nocase
        $traversal3 = "..%2f..%2f" ascii wide nocase
        $magic = { 37 7A BC AF 27 1C } // 7z magic bytes
    condition:
        $magic at 0 and (any of ($traversal*))
}

Sigma Rule

title: CVE-2024-12389 - Path Traversal via 7z Archive Extraction
id: 8f9e3c2a-1b5d-4e7f-9a0c-3d6e8f2b1a4c
status: experimental
description: Detects file writes to sensitive directories following 7z extraction in gpt_academic
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/python3'
        TargetFilename|contains:
            - '/tmp/'
            - '/etc/'
            - '/var/www/'
            - '/root/'
            - '/home/'
        TargetFilename|endswith:
            - '.py'
            - '.sh'
            - '.conf'
            - '.php'
    condition: selection
falsepositives:
    - Legitimate file writes by the application
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12389 - Potential 7z Path Traversal Upload"; flow:to_server; content:"Content-Type|3a| application/x-7z-compressed"; nocase; http_header; content:"../../"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the 7z extraction feature in gpt_academic until a patch is available.
2. Apply input validation to reject archives containing path traversal sequences (e.g., ../, ..\\).
3. Use a sandboxed extraction environment (e.g., Docker container with read-only root filesystem, or a chroot jail).

Long-term Fix:

• Update to a patched version of gpt_academic once released.
• Implement path sanitization in the extraction code (see patched code example above).
• Consider using a safer extraction library or adding a whitelist of allowed file paths.

Workaround:

• If the feature cannot be disabled, restrict the extraction directory to a dedicated, non-executable location (e.g., /var/lib/gpt_academic/extracted/) and ensure the web server user has no write permissions to sensitive directories.

Valters IT