CVE-2024-8143

Executive Summary

CVE-2024-8143 is an authorization bypass vulnerability in gaizhenbiao/chuanhuchatgpt, version 20240628. The flaw resides in the /file endpoint, allowing an authenticated attacker to enumerate and access other users' private chat history directories. By manipulating the file path parameter, an attacker can traverse into other users' folders and read sensitive conversation data. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched. No public exploit code or Nuclei template is available, but the attack vector is straightforward and requires only low-privilege authentication.

Supply Chain & Package Security

This is a Python-based application (chuanhuchatgpt) distributed via GitHub. No official PyPI package is known. The vulnerability exists in the application's own file-serving logic, not in a third-party dependency. However, users should verify the integrity of their deployment and monitor for any unofficial forks or patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker must be authenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Complete disclosure of other users' chat histories.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires authentication but allows broad lateral access to sensitive data. In multi-tenant deployments, this could lead to mass data leakage.

Deep Dive & Mechanics

The application creates a directory under /history for each authenticated user, named after the username. The /file endpoint is designed to serve files from these directories. However, it fails to validate that the requested file path belongs to the requesting user. By supplying a path like ../otheruser/chat.log, an attacker can traverse into another user's directory and read their chat history.

The core issue is an Insecure Direct Object Reference (IDOR) combined with Path Traversal. The endpoint likely uses a user-supplied filename parameter without sanitizing directory traversal sequences (../). Since the application does not enforce that the requested file resides within the authenticated user's own directory, any authenticated user can access any file under the /history root.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

@app.route('/file')
def get_file():
    user = session['username']
    filename = request.args.get('filename')
    # No validation that filename is within user's directory
    filepath = os.path.join('history', filename)
    return send_file(filepath)

Patched Code (conceptual):

@app.route('/file')
def get_file():
    user = session['username']
    filename = request.args.get('filename')
    # Sanitize: ensure no path traversal
    safe_filename = os.path.basename(filename)
    filepath = os.path.join('history', user, safe_filename)
    if not os.path.exists(filepath):
        abort(404)
    return send_file(filepath)

The patch must:

1. Restrict file access to the user's own directory.
2. Use os.path.basename() to strip directory components.
3. Optionally, verify that the resolved path starts with the user's directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of chuanhuchatgpt (version 20240628).
• Valid credentials for any user account.

Exploitation Steps:

1. Log in and obtain a session cookie.
2. Enumerate other users by listing directories under /history (if directory listing is enabled) or by guessing usernames.
3. Send a crafted request to the /file endpoint:

   GET /file?filename=../victim_user/chat_history.txt HTTP/1.1
   Cookie: session=your_session_token
   

4. The server returns the victim's chat history.

Example using curl:

curl -b "session=attacker_session" "http://target:5000/file?filename=../admin/chat.log"

Blue Team

Detection:

• Monitor for requests to /file containing ../ or other path traversal patterns.
• Alert on multiple requests to different user directories from the same session.
• Log all file access attempts and correlate with user identity.

Hunting:

• Search web server logs for filename parameters containing .. or absolute paths.
• Look for anomalous access patterns where a single user requests files from multiple user directories.

Lab Setup:

• Deploy chuanhuchatgpt in a sandboxed environment.
• Create two test users: alice and bob.
• As alice, attempt to access bob's files using the traversal technique.
• Verify that the attack succeeds and that logs capture the malicious request.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /file with filename parameter containing ../ or absolute paths.
• Logs: Web server access logs showing GET /file?filename=../ from authenticated sessions.
• File System: Unauthorized reads of files under /history/ directories not belonging to the requesting user.
• Behavior: A single user session accessing multiple user directories in rapid succession.

Detection Engineering

YARA Rule

rule CVE_2024_8143_PathTraversal {
    meta:
        description = "Detects path traversal attempts in chuanhuchatgpt /file endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-8143"
    strings:
        $traversal = "../"
        $abs_path = "/history/"
    condition:
        any of ($traversal, $abs_path) and
        # of files > 0
}

Sigma Rule

title: CVE-2024-8143 Path Traversal in chuanhuchatgpt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts against the /file endpoint
author: Valters IT
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/file'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-8143 chuanhuchatgpt Path Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/file"; http_uri;
    content:"../"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the /file endpoint if not essential, or restrict it to only serve files from the authenticated user's directory.
2. Apply input validation – strip ../ and enforce that the filename is a simple basename.
3. Implement directory whitelisting – ensure the resolved path starts with the user's own history directory.

Long-term Fix:

• Upgrade to a patched version once available.
• Conduct a security audit of all file-serving endpoints.
• Implement proper authorization checks for every resource access.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests containing ../ in the query string:

  if ($args ~ "\.\.") {
      return 403;
  }
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert