CVE-2024-5278 Unrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgpt

What is CVE-2024-5278?

CVE-2024-5278 is a medium-severity vulnerability in gaizhenbiao/chuanhuchatgpt, published on 6 Jun 2024.

Official description

gaizhenbiao/chuanhuchatgpt is vulnerable to an unrestricted file upload vulnerability due to insufficient validation of uploaded file types in its `/upload` endpoint. Specifically, the `handle_file_upload` function does not sanitize or validate the file extension or content type of uploaded files, allowing attackers to upload files with arbitrary extensions, including HTML files containing XSS payloads and Python files. This vulnerability, present in the latest version as of 20240310, could lead to stored XSS attacks and potentially result in remote code execution (RCE) on the server hosting the application.

Weakness: CWE-434

Which versions are affected by CVE-2024-5278?

It affects 1 product.

Products include Gaizhenbiao Chuanhuchatgpt.

How do I fix CVE-2024-5278?

No fix has been published for CVE-2024-5278 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-5278 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5278 exists.

Other vulnerabilities in gaizhenbiao/chuanhuchatgpt

• CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt Critical 9.8
• CVE-2024-5982 Path Traversal in gaizhenbiao/chuanhuchatgpt Critical 9.1
• CVE-2024-6255 Path Traversal in gaizhenbiao/chuanhuchatgpt High 8.2
• CVE-2024-8613 Improper Access Control in gaizhenbiao/chuanhuchatgpt High 8.1
• CVE-2024-9216 Authentication Bypass in gaizhenbiao/ChuanhuChatGPT High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8v63-8v7j-hvg8.