CVE-2024-12390

Executive Summary

CVE-2024-12390 is a critical Remote Code Execution (RCE) vulnerability in the binary-husky/gpt_academic project, specifically at commit git 310122f. The vulnerability resides in the application's handling of user-uploaded RAR archive files. The application uses the Python rarfile module to extract archives without validating the presence of symbolic links (symlinks) within the archive. An attacker can craft a malicious RAR file containing a symlink that points to an arbitrary file on the system (e.g., SSH authorized_keys, crontab, or application source code). Upon extraction, the symlink is followed, allowing the attacker to write arbitrary content to the target file, leading to full remote code execution.

Supply Chain & Package Security

This vulnerability is not a direct supply chain attack on a package registry (PyPI, NPM, etc.), but it involves the rarfile Python module. The rarfile module itself is not inherently vulnerable; the vulnerability is due to the application's insecure usage of the module by not disabling symlink extraction. Users of gpt_academic are at risk if they allow untrusted users to upload RAR files. The project is self-hosted, so the attack surface is limited to instances that expose the file upload functionality to untrusted users.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): None - No authentication is needed to upload a file.
• User Interaction (UI): Required - The victim must extract the malicious RAR file (e.g., by using the application's file processing feature).
• Scope (S): Unchanged - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High - An attacker can read sensitive files (e.g., SSH keys, application config).
• Integrity (I): High - An attacker can overwrite critical files (e.g., crontab, application code).
• Availability (A): High - An attacker can disrupt the service by overwriting critical files.

Threat Level: Critical. The vulnerability allows for unauthenticated remote code execution with low complexity, making it highly attractive to attackers.

Deep Dive & Mechanics

The vulnerability is a classic case of arbitrary file write via symlink in an archive. The gpt_academic application uses the Python rarfile module to extract RAR archives uploaded by users. The rarfile module, by default, supports the extraction of symbolic links. If an archive contains a symlink pointing to an absolute path (e.g., /home/user/.ssh/authorized_keys), the extraction process will follow the symlink and write the extracted file's content to the target location.

Attack Flow:

1. Craft Malicious RAR: The attacker creates a RAR archive containing a symlink entry. The symlink points to a sensitive file, such as /home/user/.ssh/authorized_keys. The archive also contains a regular file (e.g., authorized_keys) that will be written through the symlink.
2. Upload: The attacker uploads the malicious RAR file to the gpt_academic instance.
3. Extraction: The application extracts the archive using rarfile.extractall() or similar, without checking for symlinks.
4. Symlink Follow: The rarfile module creates the symlink, then writes the content of the regular file to the path pointed to by the symlink.
5. Code Execution: The attacker can now SSH into the server using their own SSH key, or if they overwrite a crontab file, they can execute arbitrary commands. Overwriting application code (e.g., a Python file) can also lead to immediate RCE when the application reloads.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely uses rarfile.extractall() without any validation.

import rarfile

def extract_rar(file_path, extract_path):
    with rarfile.RarFile(file_path) as rf:
        rf.extractall(extract_path)  # Vulnerable: no symlink check

Patched Code (Conceptual): A patched version would need to either:

1. Disable symlink extraction in the rarfile module (if supported).
2. Manually iterate over the archive members and reject any that are symlinks.

import rarfile
import os

def extract_rar_safe(file_path, extract_path):
    with rarfile.RarFile(file_path) as rf:
        for member in rf.infolist():
            # Check if the member is a symlink
            if member.is_symlink():
                raise ValueError("Symlinks are not allowed in uploaded archives")
            # Also check for path traversal
            if ".." in member.filename or member.filename.startswith("/"):
                raise ValueError("Invalid file path in archive")
        rf.extractall(extract_path)

Note: The rarfile module's RarInfo object may have a is_symlink() method. If not, the developer must check the member.filename for absolute paths or .. sequences, and also check the member.linkname attribute.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Target: A local instance of gpt_academic at commit git 310122f running on a Linux VM.
2. Attacker: Kali Linux VM.
3. Tool: rar command-line tool to create the malicious archive.

Exploit Steps:

1. Create Malicious RAR:

   # Create a symlink pointing to the target file (e.g., SSH authorized_keys)
   ln -s /home/user/.ssh/authorized_keys evil_link
   # Create a file containing the attacker's SSH public key
   echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..." > authorized_keys
   # Create the RAR archive with the symlink and the file
   rar a malicious.rar evil_link authorized_keys
   

2. Upload: Upload malicious.rar to the gpt_academic instance via the file upload feature.

3. Trigger Extraction: The application will automatically extract the archive. The symlink evil_link will be created, and the content of authorized_keys will be written to /home/user/.ssh/authorized_keys.

4. Gain Access: SSH into the target machine using the attacker's private key.

   ssh -i private_key user@target_ip
   

Alternative Payloads:

• Crontab: Symlink to /var/spool/cron/crontabs/user and write a cron job that executes a reverse shell.
• Application Code: Symlink to a Python file in the application directory (e.g., config.py) and inject malicious code.

Blue Team (Detection & Response)

Detection:

1. Monitor File Uploads: Log all file uploads, especially archive files (.rar, .zip, .tar.gz).
2. Monitor Symlink Creation: Use auditd or eBPF to monitor for symlink creation events in the application's upload directory.
3. Monitor Sensitive File Writes: Alert on writes to critical files like /home/*/.ssh/authorized_keys, /etc/crontab, /var/spool/cron/, and application source files.

Response:

1. Isolate: Immediately isolate the affected server from the network.
2. Analyze: Examine the uploaded archive and the extracted files. Check for symlinks.
3. Contain: Remove any unauthorized SSH keys, revert crontab changes, and restore any overwritten application files from backup.
4. Patch: Apply the fix (disable symlink extraction) or temporarily disable the file upload feature.

Indicators of Compromise (IOCs)

• Network:
  • Outbound SSH connections from the server to an unknown IP.
  • Reverse shell connections (e.g., to a common C2 port like 4444, 8080).
• File System:
  • Unexpected symlinks in the application's upload directory.
  • New entries in /home/*/.ssh/authorized_keys.
  • Modified crontab files.
  • Unexpected changes to application source files (e.g., config.py, main.py).
• Process:
  • Unusual processes spawned by the web server user (e.g., bash, python, nc).
  • Cron jobs executing unknown commands.
• Logs:
  • Application logs showing extraction of RAR files with unusual paths.
  • System logs (auth.log, syslog) showing SSH login attempts from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_12390_Malicious_RAR_Symlink {
    meta:
        description = "Detects RAR files containing symlinks targeting sensitive paths"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-12390"
        hash = "unknown"
    strings:
        $rar_magic = { 52 61 72 21 1A 07 00 } // RAR magic bytes
        $symlink_indicator = { 2E 2E 2F } // "../" in path
        $ssh_path = "/.ssh/authorized_keys" ascii wide nocase
        $cron_path = "/crontab" ascii wide nocase
        $etc_path = "/etc/" ascii wide nocase
    condition:
        $rar_magic at 0 and
        (any of ($symlink_indicator, $ssh_path, $cron_path, $etc_path))
}

Sigma Rule

title: CVE-2024-12390 - Malicious RAR Upload to gpt_academic
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects upload of RAR files containing symlinks to sensitive system files.
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12390
logsource:
    category: application
    product: gpt_academic
detection:
    selection:
        EventID: 11  # FileCreate (Sysmon)
        TargetFilename|contains: '.rar'
    filter:
        TargetFilename|endswith: '.rar'
    condition: selection and not filter
falsepositives:
    - Legitimate RAR files without symlinks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-12390 - Potential Malicious RAR Upload to gpt_academic"; flow:to_server,established; content:"multipart/form-data"; http_content_type; content:".rar"; http_client_body; pcre:"/(\.\.\/|\/\.ssh\/|\/crontab|\/etc\/)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable File Upload: Temporarily disable the RAR file upload feature in gpt_academic until a patch is applied.
2. Restrict Permissions: Ensure the application runs with the least privileges necessary. The web server user should not have write access to sensitive system files like SSH keys or crontab.
3. Input Validation: Implement strict validation of uploaded archives. Reject any archive containing symlinks or files with absolute paths.

Long-Term Fix:

1. Patch the Code: Modify the extraction logic to explicitly check for and reject symlinks. Use the rarfile module's is_symlink() method if available, or manually check the linkname attribute.
2. Use a Safe Extraction Library: Consider using a library that does not support symlinks by default, or configure the existing library to disable symlink extraction.
3. Sandboxing: Run the extraction process in a sandboxed environment (e.g., Docker container with read-only root filesystem) to limit the impact of a successful exploit.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.