CVE-2024-10650: Chuanhuchatgpt DoS Vulnerability

CVE-2024-10650 Overview

CVE-2024-10650 is an unauthenticated Denial of Service (DoS) vulnerability in ChuanhuChatGPT version 20240918. Attackers can exploit the flaw by submitting large data payloads using a multipart boundary. The issue represents a bypass of the earlier fix for CVE-2024-7807, which failed to account for payloads structured as groups of 10 characters per line across multiple lines. Processing these crafted payloads consumes system resources and causes prolonged service unavailability. Following a Gradio version upgrade, exploitation now requires low privileges when authentication is enabled.

Critical Impact

Remote attackers can render ChuanhuChatGPT deployments unavailable by sending crafted multipart payloads that trigger sustained resource consumption. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling).

Affected Products

• Gaizhenbiao ChuanhuChatGPT version 20240918
• Deployments running the upgraded Gradio dependency
• Any exposed instance reachable over the network

Discovery Timeline

• 2025-03-20 - CVE-2024-10650 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10650

Vulnerability Analysis

The vulnerability resides in ChuanhuChatGPT's handling of multipart-encoded HTTP request bodies. The application processes each line of the multipart payload without enforcing effective size or rate limits. A previous patch addressed CVE-2024-7807, which described a similar resource exhaustion condition. That patch did not sufficiently constrain input structured as many short lines. Attackers can therefore submit payloads containing groups of 10 characters per line, repeated across many lines, to defeat the mitigation.

The server iterates through each line and performs processing that scales with input size. Because the request is accepted without authentication in default deployments, any network-reachable attacker can trigger the condition. When authentication is enabled through the updated Gradio component, exploitation still succeeds with low-privileged credentials.

Root Cause

The root cause is missing input throttling and unbounded resource allocation during multipart parsing. The prior fix constrained specific payload shapes but did not enforce upper bounds on aggregate input processing time or cumulative line count. See the Huntr Bug Bounty Report for the technical write-up.

Attack Vector

Exploitation requires only network access to the ChuanhuChatGPT web interface. The attacker sends an HTTP request with a multipart body containing many short lines separated by the multipart boundary. The server processes each line, consuming CPU and memory until legitimate users can no longer interact with the service. No user interaction is required, and the impact is limited to availability. Confidentiality and integrity are not affected.

See the Huntr Bug Bounty Report for technical details on payload construction.

Detection Methods for CVE-2024-10650

Indicators of Compromise

• Sustained high CPU or memory usage on the ChuanhuChatGPT process during or after inbound HTTP traffic
• HTTP POST requests with unusually large multipart/form-data bodies containing many short lines
• Repeated multipart boundary markers within a single request body
• Loss of responsiveness on the Gradio web interface

Detection Strategies

• Inspect web server and reverse proxy logs for POST requests with abnormally large Content-Length values targeting Gradio endpoints
• Deploy a web application firewall rule that flags multipart bodies exceeding a reasonable line count threshold
• Correlate HTTP request patterns with process-level resource metrics on the application host

Monitoring Recommendations

• Alert when the ChuanhuChatGPT process sustains CPU utilization above expected baselines for more than 60 seconds
• Monitor request duration and body size distributions at the reverse proxy layer
• Track application health checks and log service restart events triggered by resource exhaustion

How to Mitigate CVE-2024-10650

Immediate Actions Required

• Restrict network exposure of ChuanhuChatGPT instances to trusted networks or VPN access only
• Enable authentication on all ChuanhuChatGPT deployments to raise the exploitation barrier
• Place the application behind a reverse proxy that enforces request size and rate limits
• Monitor upstream project channels for a patched release addressing the CVE-2024-7807 bypass

Patch Information

No vendor advisory or patched release addressing the CVE-2024-7807 bypass is listed in the NVD data at the time of publication. Operators should track the Huntr Bug Bounty Report and the upstream ChuanhuChatGPT repository for remediation updates.

Workarounds

• Configure the reverse proxy to limit client_max_body_size and request timeout values for multipart uploads
• Apply rate limiting on the Gradio endpoint to cap requests per source IP
• Terminate connections that exceed a defined multipart line count or processing duration
• Isolate the application in a container with strict CPU and memory limits to contain resource exhaustion

# Example nginx reverse proxy configuration
http {
    client_max_body_size 1m;
    client_body_timeout 10s;

    limit_req_zone $binary_remote_addr zone=chuanhu:10m rate=10r/s;

    server {
        listen 443 ssl;
        server_name chuanhu.example.com;

        location / {
            limit_req zone=chuanhu burst=20 nodelay;
            proxy_pass http://127.0.0.1:7860;
            proxy_read_timeout 30s;
        }
    }
}