CVE-2024-10956: Binary-husky GPT Academic XSS Vulnerability

CVE-2024-10956 Overview

CVE-2024-10956 is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability in binary-husky/gpt_academic version 3.83. The application establishes WebSocket connections between the browser and server without enforcing origin validation or robust WebSocket authentication. An attacker who lures an authenticated user to a malicious page can hijack the user's active WebSocket session and issue unauthorized actions on their behalf, including deletion of conversation history. The flaw is classified as [CWE-346] Origin Validation Error and affects the integrity of user data in the GPT Academic web interface.

Critical Impact
Authenticated user sessions can be hijacked cross-origin, allowing attackers to delete conversation history and trigger server-side actions without consent.

Affected Products

binary-husky gpt_academic version 3.83
Deployments exposing the GPT Academic WebSocket endpoint to browser clients
Instances without reverse-proxy origin enforcement or WebSocket authentication controls

Discovery Timeline

2025-03-20 - CVE-2024-10956 published to the National Vulnerability Database
2025-07-15 - Last updated in NVD database

Technical Details for CVE-2024-10956

Vulnerability Analysis

GPT Academic 3.83 accepts WebSocket upgrade requests without verifying the Origin header against an allowlist. Browsers attach existing session cookies to cross-origin WebSocket handshakes by default. A malicious site loaded in the victim's browser can therefore open a WebSocket to the GPT Academic server and inherit the victim's authentication context. The server treats the hijacked connection as legitimate and processes any commands transmitted over it. The attack requires user interaction, since the victim must visit the attacker-controlled page, but no credentials or privileges are needed by the attacker.

Root Cause

The root cause is missing origin validation on the WebSocket handshake combined with reliance on ambient cookie authentication. The server does not implement a per-connection token, CSRF-style nonce, or Sec-WebSocket-Protocol challenge that would bind the WebSocket session to the originating application. As a result, the same-origin policy that normally protects HTTP endpoints does not extend to WebSocket upgrades.

Attack Vector

The attack proceeds over the network and requires the victim to load a malicious page while authenticated to a GPT Academic instance. The attacker's page issues a new WebSocket("ws://target/...") request. The browser includes the victim's session cookies in the upgrade. Once the connection is established, the attacker's JavaScript sends application-level messages, such as the command to delete conversation history. Because the connection is bidirectional, the attacker can also read server responses and exfiltrate session data subject to the application's message schema.

No verified exploit code is published. Refer to the Huntr Bounty Report for technical details on the disclosed scenario.

Detection Methods for CVE-2024-10956

Indicators of Compromise

WebSocket upgrade requests to GPT Academic endpoints carrying an Origin header that does not match the deployed application hostname.
Unexpected conversation history deletion events in application logs that correlate with active user browsing sessions.
Connections initiated immediately after a user visited an external URL referenced in browser history or proxy logs.

Detection Strategies

Inspect reverse-proxy or application logs for WebSocket handshakes where Origin is absent, null, or set to an external domain.
Correlate destructive API calls such as conversation deletions with the originating WebSocket session metadata.
Hunt for outbound user traffic to suspicious domains immediately preceding sensitive in-app actions.

Monitoring Recommendations

Enable verbose WebSocket connection logging at the ingress layer, including the Origin, Referer, and User-Agent headers.
Forward web and proxy telemetry to a centralized analytics platform such as Singularity Data Lake to query handshake metadata at scale.
Alert on any WebSocket session that issues bulk destructive operations within seconds of connection establishment.

How to Mitigate CVE-2024-10956

Immediate Actions Required

Restrict access to GPT Academic instances to trusted networks or VPN clients until a patched release is deployed.
Place the application behind a reverse proxy that enforces an explicit Origin allowlist on WebSocket upgrades.
Require users to log out of GPT Academic when not actively using it to reduce the window of session reuse.

Patch Information

No vendor patch URL is referenced in the NVD record at the time of writing. Monitor the binary-husky/gpt_academic repository and the Huntr Bounty Report for fix availability. Upgrade beyond version 3.83 once a release explicitly addresses CSWSH by adding origin validation and per-session WebSocket tokens.

Workarounds

Configure the reverse proxy to reject WebSocket upgrades whose Origin header does not match the application's canonical hostname.
Issue a short-lived CSRF token at login and require it as the first message on every new WebSocket connection.
Set authentication cookies with SameSite=Strict and Secure attributes to block cross-site cookie attachment.
Deploy a Content Security Policy that restricts the domains from which the application can be framed or referenced.

bash

# Example nginx origin allowlist for WebSocket upgrades
map $http_origin $origin_ok {
    default 0;
    "https://gptacademic.example.com" 1;
}

server {
    listen 443 ssl;
    server_name gptacademic.example.com;

    location /ws {
        if ($origin_ok = 0) { return 403; }
        proxy_pass http://gpt_academic_upstream;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}