CVE-2024-11031: Binary-husky Gpt Academic SSRF Vulnerability

CVE-2024-11031 is a Server-Side Request Forgery flaw in Binary-husky Gpt Academic version 3.83 that enables attackers to download arbitrary web resources through insufficient URL validation. This article covers the technical details, affected versions, security impact, and available mitigation strategies.

CVE-2024-11031 Overview

CVE-2024-11031 is a Server-Side Request Forgery (SSRF) vulnerability in binary-husky/gpt_academic version 3.83. The flaw resides in the Markdown_Translate.get_files_from_everything() API and is reachable through the HotReload(Markdown翻译中) plugin function. The affected code validates remote links only by checking whether the URL begins with http, permitting requests to arbitrary hosts. Attackers can abuse the victim GPT Academic Gradio web server's network position and credentials to reach unauthorized internal or external web resources. The weakness is tracked as CWE-918.

Critical Impact
Unauthenticated remote attackers can coerce the Gradio server to issue outbound HTTP requests to attacker-chosen hosts, enabling internal network reconnaissance and access to metadata services.

Affected Products

binary-husky gpt_academic version 3.83
Deployments exposing the Gradio web interface
Instances loading the Markdown translation plugin (HotReload(Markdown翻译中))

Discovery Timeline

2025-03-20 - CVE-2024-11031 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11031

Vulnerability Analysis

The vulnerability exists in the get_files_from_everything() helper within the Markdown translation module. The function accepts a user-supplied URL and fetches its contents to feed into the translation pipeline. Input validation is limited to a prefix check confirming the string starts with http, which does not restrict the destination host, port, or address family. As a result, an attacker can supply URLs targeting internal services such as http://127.0.0.1, private network ranges, or cloud metadata endpoints like http://169.254.169.254. The Gradio server then executes the outbound request on the attacker's behalf and returns the response body into the application context. Because the endpoint requires no authentication and no user interaction, exploitation can be automated at scale against exposed instances.

Root Cause

The root cause is missing URL validation and allow-listing in Markdown_Translate.get_files_from_everything(). The code trusts scheme-only checks and does not resolve destination IPs, block private ranges, or restrict redirects. This design pattern is the classic anti-pattern described by CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation is network-based and requires no privileges. An attacker submits a crafted Markdown translation request through the HotReload plugin flow that points the fetcher at a chosen URL. The server-side handler downloads the resource, exposing internal HTTP services or cloud instance metadata to the attacker. Additional detail is documented in the Huntr Security Bounty report. No verified public exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-11031

Indicators of Compromise

Outbound HTTP requests from the gpt_academic host to internal RFC1918 addresses or loopback interfaces
Requests to cloud metadata endpoints such as 169.254.169.254 originating from the Gradio process
Application logs showing calls to Markdown_Translate.get_files_from_everything() with URLs that do not match trusted document sources

Detection Strategies

Inspect reverse-proxy or WAF logs for translation plugin requests carrying URL parameters targeting non-public hosts
Correlate process-level network telemetry from the Python interpreter running gpt_academic with unexpected destination IPs
Alert on repeated HTTP 200 responses from internal services immediately following user-facing plugin invocations

Monitoring Recommendations

Enable verbose logging on the Gradio server to capture full plugin request parameters, including submitted URLs
Deploy egress filtering and log all outbound HTTP requests from the application host for anomaly review
Monitor cloud provider audit trails for unexpected identity or metadata API access from the workload

How to Mitigate CVE-2024-11031

Immediate Actions Required

Restrict network egress from the gpt_academic host to a documented allow-list of translation service endpoints
Block the workload from reaching internal RFC1918 ranges, loopback, and cloud metadata IPs at the network layer
Disable or remove the HotReload(Markdown翻译中) plugin until a fixed release is deployed
Place the Gradio web interface behind authentication and limit exposure to trusted users only

Patch Information

At the time of publication, no vendor patch URL is listed in the NVD entry. Consult the upstream binary-husky/gpt_academic repository and the Huntr disclosure for remediation status and upgrade guidance beyond version 3.83.

Workarounds

Wrap get_files_from_everything() calls with a URL validator that resolves the hostname and rejects private, loopback, link-local, and metadata addresses
Enforce an allow-list of permitted domains for document downloads instead of accepting any http-prefixed URL
Run the gpt_academic container in a network namespace with no route to internal management networks or cloud metadata services

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP