CVE-2024-12390: Binary-husky Gpt Academic RCE Vulnerability

CVE-2024-12390 Overview

CVE-2024-12390 is a remote code execution vulnerability in binary-husky/gpt_academic at git commit 310122f. The application extracts user-provided RAR archives without validating their contents. The underlying Python rarfile module honors symbolic links inside archives, allowing an authenticated attacker to write arbitrary files outside the intended extraction directory. Attackers can weaponize this primitive by overwriting sensitive files such as SSH authorized keys, crontab entries, or the application's own Python source. The result is reliable remote code execution against the host running the AI assistant. The weakness is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
An authenticated user can achieve remote code execution on the host by uploading a crafted RAR archive that abuses symlink handling to overwrite security-sensitive files.

Affected Products

binary-husky/gpt_academic git commit 310122f
CPE-listed build dated 2024-10-15
Deployments that expose the RAR extraction feature to authenticated users

Discovery Timeline

2025-03-20 - CVE-2024-12390 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-12390

Vulnerability Analysis

The flaw is a symlink-following file write in the archive extraction path of gpt_academic. The application accepts RAR uploads and passes them to Python's rarfile module for decompression. rarfile preserves symbolic link entries stored inside the archive and writes them to disk during extraction. Because the extractor does not validate link targets or normalize resolved paths, an attacker can direct writes to arbitrary locations on the file system.

This primitive converts a benign-looking file upload into arbitrary file write with the privileges of the service process. Writing to files that are later executed by the operating system or the application itself yields code execution. Common targets include ~/.ssh/authorized_keys for persistent SSH access, /etc/cron.d/* for scheduled execution, and the application's own Python modules for immediate execution on the next import.

Root Cause

The root cause is unsafe use of the rarfile library without post-extraction path validation. The extraction routine does not verify that each entry, after symlink resolution, remains within the intended extraction directory. This is a classic [CWE-59] link-following weakness compounded by trusting attacker-controlled archive metadata.

Attack Vector

Exploitation requires network access to the application and low-privilege authentication. An attacker crafts a RAR archive containing a symbolic link entry that points to a sensitive location outside the extraction directory, followed by a regular file entry that writes through that symlink. When gpt_academic extracts the archive, the malicious link is created and the payload file is written to the attacker-chosen destination. No user interaction beyond the attacker's own upload action is required.

Refer to the Huntr bounty listing for the reported reproduction context.

Detection Methods for CVE-2024-12390

Indicators of Compromise

Unexpected modifications to ~/.ssh/authorized_keys, /etc/cron.d/, /etc/crontab, or /var/spool/cron/ on hosts running gpt_academic.
Newly created symbolic links inside the application's RAR extraction working directory that resolve outside of it.
Modifications to gpt_academic Python source files with timestamps that correlate to user upload activity.

Detection Strategies

Instrument the extraction workflow to log every archive entry name, entry type, and final resolved path, and alert when a resolved path escapes the target directory.
Monitor process telemetry for the gpt_academic service spawning shells, ssh, cron, or Python subprocesses shortly after archive uploads.
Correlate authenticated upload events with subsequent file writes under sensitive directories using endpoint or file-integrity telemetry.

Monitoring Recommendations

Enable file integrity monitoring on ~/.ssh, /etc/cron*, and the gpt_academic install directory.
Retain web access logs for upload endpoints and join them with host telemetry to reconstruct extraction activity.
Alert on creation of symlinks by the service account outside of its designated working directory.

How to Mitigate CVE-2024-12390

Immediate Actions Required

Disable or restrict the RAR upload and extraction feature until a fixed version is deployed.
Limit access to gpt_academic to trusted users and enforce strong authentication on all accounts.
Run the service under a dedicated, unprivileged system account with no write access to ~/.ssh, cron directories, or the application source tree.

Patch Information

No vendor advisory or fixed release is referenced in the NVD entry at the time of publication. Track the upstream binary-husky/gpt_academic repository and the Huntr bounty listing for remediation status. Until an official patch is available, apply the workarounds below.

Workarounds

Reject archive entries whose type is a symbolic link before extraction, or switch to an extraction routine that skips link entries entirely.
After extraction, validate that every resolved path is a child of the intended extraction directory and delete any entry that escapes it.
Extract uploaded archives inside an ephemeral container, chroot, or sandbox with no access to host secrets or application code.
Apply mandatory access controls (SELinux, AppArmor) that deny the service process write access to ~/.ssh, /etc/cron*, and its own installation directory.

bash

# Configuration example: run gpt_academic under a restricted user with a
# read-only application directory and an isolated extraction workspace.
sudo useradd --system --home /var/lib/gpt_academic --shell /usr/sbin/nologin gptacad
sudo chown -R root:gptacad /opt/gpt_academic
sudo chmod -R o-rwx,g-w /opt/gpt_academic
sudo install -d -o gptacad -g gptacad -m 0700 /var/lib/gpt_academic/extract
# Ensure the service unit sets: ProtectHome=yes, ReadOnlyPaths=/opt/gpt_academic,
# and NoNewPrivileges=yes to contain any successful symlink write.