CVE-2024-6255: Chuanhuchatgpt Path Traversal Vulnerability

CVE-2024-6255 Overview

A critical directory traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410 that allows any user to delete arbitrary JSON files on the server. This vulnerability arises from improper validation of file paths in the JSON file handling functionality, enabling attackers to traverse directories and target files outside the intended scope. Critical configuration files such as config.json and ds_config_chatbot.json are at risk, potentially leading to system disruption, settings manipulation, and data loss or corruption.

Critical Impact

Unauthenticated attackers can delete any JSON file on the server through directory traversal, including critical configuration files, leading to denial of service and potential data corruption.

Affected Products

• gaizhenbiao chuanhuchatgpt version 20240410
• ChuanhuChatGPT installations with default file handling configurations

Discovery Timeline

• 2024-07-31 - CVE-2024-6255 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6255

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) occurs in the JSON file handling component of ChuanhuChatGPT. The application fails to properly sanitize user-supplied file path inputs, allowing attackers to use directory traversal sequences (such as ../) to escape the intended directory and access files elsewhere on the file system.

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this flaw to delete critical JSON configuration files that the application depends on for proper operation. The impact is significant for both integrity (arbitrary file deletion) and availability (service disruption through removal of essential configuration files).

Root Cause

The root cause of CVE-2024-6255 is the lack of proper input validation and path canonicalization in the file deletion functionality. When processing user requests to delete JSON files, the application directly incorporates user-supplied path components without verifying that the resulting path remains within the allowed directory boundaries. This allows malicious path sequences like ../../../config.json to reference files outside the intended storage location.

Attack Vector

The vulnerability is exploited through network-based requests to the ChuanhuChatGPT application. An attacker crafts a malicious request containing directory traversal sequences in the file path parameter. Since no authentication is required, any remote user can target the application.

The attack flow involves:

1. Identifying the JSON file deletion endpoint in the ChuanhuChatGPT application
2. Crafting a request with directory traversal sequences (e.g., ../../config.json)
3. Submitting the request to delete critical configuration files
4. The application processes the path without validation and deletes the specified file

Technical details of the vulnerability can be found in the Huntr Bug Bounty Report.

Detection Methods for CVE-2024-6255

Indicators of Compromise

• Unexpected deletion of JSON configuration files (e.g., config.json, ds_config_chatbot.json)
• Application errors or crashes related to missing configuration files
• HTTP request logs containing directory traversal patterns (../, ..%2F, ..%252F)
• Unusual file system activity in directories outside the application's intended scope

Detection Strategies

• Monitor web server access logs for requests containing directory traversal sequences targeting JSON file endpoints
• Implement file integrity monitoring (FIM) on critical configuration files to detect unauthorized deletions
• Deploy web application firewall (WAF) rules to detect and block path traversal attempts
• Configure application-level logging to capture file deletion operations with full path information

Monitoring Recommendations

• Enable verbose logging for all file system operations in the ChuanhuChatGPT application
• Set up alerts for configuration file changes or deletions using file integrity monitoring solutions
• Monitor application health metrics to detect service disruptions caused by missing configuration files
• Regularly audit access logs for suspicious request patterns indicative of traversal attacks

How to Mitigate CVE-2024-6255

Immediate Actions Required

• Restrict network access to ChuanhuChatGPT instances to trusted users only until a patch is applied
• Implement WAF rules to block requests containing directory traversal patterns
• Enable file integrity monitoring on critical JSON configuration files
• Back up all configuration files and establish a recovery procedure
• Consider disabling the JSON file deletion functionality if not essential to operations

Patch Information

Organizations should monitor the official gaizhenbiao/chuanhuchatgpt repository for security updates addressing this vulnerability. As no vendor advisory was available at the time of publication, check the Huntr Bug Bounty Report for the latest remediation guidance.

Workarounds

• Deploy a reverse proxy or WAF with rules to sanitize and block path traversal sequences in incoming requests
• Implement operating system-level file permissions to protect critical configuration files from deletion
• Isolate the ChuanhuChatGPT application using containerization with restricted file system access
• Use read-only mounts for configuration directories where possible
• Limit the application's file system access through security profiles (AppArmor, SELinux)

# Example WAF rule for blocking directory traversal (ModSecurity format)
SecRule REQUEST_URI "@contains ../" "id:1001,phase:1,deny,status:403,msg:'Directory traversal attempt blocked'"
SecRule REQUEST_URI "@contains ..%2F" "id:1002,phase:1,deny,status:403,msg:'Encoded directory traversal blocked'"