CVE-2024-6037

Executive Summary

CVE-2024-6037 is a high-severity vulnerability (CVSS 7.5) in gaizhenbiao/chuanhuchatgpt version 20240410. The flaw allows an unauthenticated attacker to create arbitrary folders at any location on the server, including the root directory (e.g., C:). This uncontrolled resource consumption can lead to resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption. No public proof-of-concept (PoC) or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a Python-based application (chuanhuchatgpt). The application is not distributed via PyPI but is available as a GitHub repository. Users should verify the integrity of their deployment and monitor for any unauthorized file system modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the ease of exploitation and the potential for complete denial of service.

Deep Dive & Mechanics

The vulnerability resides in the file upload or directory creation functionality of chuanhuchatgpt. The application fails to properly sanitize user-supplied paths, allowing an attacker to specify arbitrary directory paths (e.g., ../../ or absolute paths like C:\). By sending a crafted request, the attacker can create folders anywhere on the server's file system.

Attack Flow:

1. The attacker sends a POST request to an endpoint that handles file uploads or directory creation.
2. The request includes a path parameter with directory traversal sequences or absolute paths.
3. The application creates the directory at the specified location without validation.
4. Repeated requests fill up the disk space, causing resource exhaustion and DoS.

Root Cause: Lack of input validation and path sanitization in the directory creation logic.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the directory creation function. A typical vulnerable implementation might look like:

# Vulnerable code (chuanhuchatgpt 20240410)
def create_directory(path):
    os.makedirs(path, exist_ok=True)

A patched version would include path validation:

# Patched code (hypothetical)
import os
import re

def create_directory(path):
    # Ensure path is within allowed base directory
    base_dir = "/app/uploads"
    full_path = os.path.normpath(os.path.join(base_dir, path))
    if not full_path.startswith(base_dir):
        raise ValueError("Invalid path")
    os.makedirs(full_path, exist_ok=True)

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy chuanhuchatgpt version 20240410 in a Docker container.
2. Expose the application on port 5000.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /create_folder or /upload).
2. Send a crafted request to create a directory in the root:

curl -X POST http://target:5000/create_folder \
  -H "Content-Type: application/json" \
  -d '{"path": "C:\\malicious_folder"}'

3. Repeat the request to fill up disk space:

for i in {1..1000}; do
  curl -X POST http://target:5000/create_folder \
    -H "Content-Type: application/json" \
    -d '{"path": "C:\\malicious_folder_'$i'"}'
done

Blue Team

Detection:

• Monitor for unusual directory creation events, especially in system root directories.
• Look for repeated POST requests to endpoints like /create_folder or /upload with path traversal patterns.

Mitigation:

• Implement strict input validation and path sanitization.
• Use a whitelist of allowed directories.
• Apply rate limiting to directory creation endpoints.

Indicators of Compromise (IOCs)

• File System Artifacts: Unexpected directories in system root (e.g., C:\malicious_folder).
• Network Traffic: Repeated POST requests to /create_folder or /upload with path traversal sequences.
• Log Entries: Application logs showing directory creation attempts outside the allowed base path.

Detection Engineering

YARA Rule

rule CVE_2024_6037_Directory_Creation {
    meta:
        description = "Detects attempts to create arbitrary directories via chuanhuchatgpt"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-6037"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\)/
        $absolute_path = /[A-Za-z]:\\/
    condition:
        $path_traversal or $absolute_path
}

Sigma Rule

title: CVE-2024-6037 - Arbitrary Directory Creation in chuanhuchatgpt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-6037 by creating directories outside allowed paths
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: chuanhuchatgpt
detection:
    selection:
        EventID: 4663  # File system audit event
        ObjectName|contains:
            - '..\\'
            - '..\/'
            - 'C:\\'
            - 'D:\\'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6037 - chuanhuchatgpt Directory Traversal"; flow:to_server; content:"POST"; http_method; content:"/create_folder"; http_uri; content:"path"; http_client_body; pcre:"/(\.\.\/|\.\.\\)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or restrict access to directory creation endpoints if not required.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Monitor file system for unexpected directory creation.

Long-term Fix:

• Apply input validation and path sanitization as shown in the patched code example.
• Use a whitelist of allowed base directories.
• Implement rate limiting and authentication for sensitive endpoints.

Workaround:

• If patching is not possible, restrict the application's file system permissions to prevent writing outside its intended directory.

Valters IT