CVE-2024-12392

Executive Summary

CVE-2024-12392 is a Server-Side Request Forgery (SSRF) vulnerability in binary-husky/gpt_academic, specifically in commit 310122f. The application includes a feature to download papers from arxiv.org, but the URL validation is incomplete. An attacker can exploit this to make the server send requests to arbitrary internal or external URLs, including cloud metadata endpoints (e.g., AWS http://169.254.169.254/latest/meta-data/), and read the responses. This can lead to exposure of sensitive internal data, such as cloud credentials, and can escalate local exploits to network-based attacks. The CVSS score is 6.5 (Medium), with high confidentiality impact. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Python-based project gpt_academic, which is distributed via GitHub and can be installed via pip or Docker. The SSRF flaw exists in the paper download functionality, which relies on user-supplied URLs. Since the project is open-source and may be used in CI/CD pipelines or cloud environments, the supply chain risk is elevated. An attacker could compromise a downstream deployment by tricking a user or automated system into fetching a malicious URL, leading to credential theft or internal network reconnaissance.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is elevated due to the potential for data exfiltration from internal services, especially in cloud environments where metadata endpoints are accessible.

Deep Dive & Mechanics

The vulnerability resides in the arxiv_download function (or similar) within gpt_academic. The application accepts a URL from the user to download a paper from arxiv.org. The validation checks only that the URL contains "arxiv.org" but does not enforce that the URL is exactly an arxiv domain. An attacker can craft a URL like http://evil.com/?arxiv.org or use URL encoding to bypass the check. Once the request is made, the server fetches the URL and returns the response to the attacker. This allows the attacker to:

• Access internal services (e.g., http://localhost:8080/admin)
• Read cloud metadata (e.g., AWS http://169.254.169.254/latest/meta-data/)
• Perform port scanning of internal networks

The lack of proper URL parsing and whitelisting is the root cause.

Vulnerable vs. Patched Code

Vulnerable Code (commit 310122f):

def download_paper(url):
    if "arxiv.org" in url:
        response = requests.get(url)
        return response.text
    else:
        raise ValueError("Invalid URL")

Patched Code (hypothetical fix):

from urllib.parse import urlparse

def download_paper(url):
    parsed = urlparse(url)
    if parsed.netloc == "arxiv.org" and parsed.scheme in ["http", "https"]:
        response = requests.get(url, timeout=10)
        return response.text
    else:
        raise ValueError("Invalid URL")

The patched version uses urlparse to validate the netloc exactly, preventing SSRF.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy gpt_academic from commit 310122f in a Docker container.
2. Set up a local HTTP server (e.g., python -m http.server 8080) to simulate an internal service.
3. Use a cloud metadata endpoint simulator (e.g., http://169.254.169.254/).

Exploitation Steps:

1. Send a POST request to the paper download endpoint with a malicious URL:

   curl -X POST http://target:port/api/download -d "url=http://169.254.169.254/latest/meta-data/"
   

2. The server will fetch the metadata and return it in the response.
3. Alternatively, use a URL like http://localhost:8080/secret.txt to read internal files.

Expected Output:

{
  "response": "ami-id\nami-launch-index\n..."
}

Blue Team

Detection:

• Monitor outbound HTTP requests from the application to unexpected IPs (e.g., 169.254.169.254, 10.x.x.x, 172.x.x.x).
• Look for URLs containing "arxiv.org" but pointing to different hosts (e.g., http://evil.com/?arxiv.org).
• Use network segmentation to block access to metadata endpoints.

Mitigation:

• Apply the hypothetical patch above.
• Restrict outbound traffic from the application using a firewall or egress proxy.
• Use a URL whitelist that only allows https://arxiv.org/abs/*.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to 169.254.169.254, localhost, or private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Logs: Application logs showing URLs with arxiv.org but different hostnames (e.g., http://evil.com/?arxiv.org).
• File: Temporary files created by the application containing cloud metadata or internal service responses.

Detection Engineering

YARA Rule

rule CVE_2024_12392_SSRF {
    meta:
        description = "Detects SSRF attempts against CVE-2024-12392 in gpt_academic"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $url1 = "arxiv.org" nocase
        $url2 = "169.254.169.254" nocase
        $url3 = "localhost" nocase
        $url4 = "10." nocase
        $url5 = "172." nocase
        $url6 = "192.168." nocase
    condition:
        any of ($url*) and #url1 > 0
}

Sigma Rule

title: CVE-2024-12392 SSRF Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts against gpt_academic
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "arxiv.org"
            - "169.254.169.254"
            - "localhost"
            - "10."
            - "172."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate arxiv.org downloads
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12392 SSRF Attempt"; flow:to_server; content:"arxiv.org"; http_uri; pcre:"/(169\.254\.169\.254|localhost|10\.|172\.|192\.168\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the paper download feature or restrict it to a whitelist of allowed domains (e.g., only https://arxiv.org/abs/*).
2. Patch: Apply the hypothetical patch using urlparse to validate the netloc exactly.
3. Network: Use egress filtering to block outbound traffic to private IP ranges and cloud metadata endpoints.
4. Monitoring: Implement logging and alerting for unusual outbound HTTP requests.
5. Upgrade: Monitor the vendor's repository for an official patch and update as soon as available.

Valters IT
DevSecOps & Cyber Threat Intelligence