CVE-2024-7807: Chuanhuchatgpt DOS Vulnerability

CVE-2024-7807 Overview

CVE-2024-7807 is a Denial of Service (DoS) vulnerability in gaizhenbiao/chuanhuchatgpt version 20240628. The flaw resides in the file upload handler, which fails to bound the length of multipart boundary strings. An attacker can append a large number of characters to the end of a multipart boundary, forcing the application to process each character sequentially. This uncontrolled resource consumption [CWE-770] renders ChuanhuChatGPT inaccessible to legitimate users. The weakness is remotely exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can render ChuanhuChatGPT unavailable by sending a single crafted multipart file upload request, disrupting operations and productivity.

Affected Products

gaizhenbiao chuanhuchatgpt version 20240628
CPE: cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:20240628:*:*:*:*:*:*:*
Deployments exposing the ChuanhuChatGPT file upload endpoint to untrusted networks

Discovery Timeline

2024-10-29 - CVE-2024-7807 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7807

Vulnerability Analysis

The vulnerability lies in how ChuanhuChatGPT parses multipart/form-data requests during file uploads. HTTP multipart messages use a boundary string, declared in the Content-Type header, to separate parts. The application processes this boundary character-by-character without enforcing a reasonable upper length limit. When an attacker submits a boundary padded with an excessive character sequence, the parser iterates over every character before continuing request handling. The resulting CPU-bound loop starves the server of processing capacity, blocking concurrent user requests. Because the exploit requires only a single crafted request and no credentials, low-effort automated abuse is feasible against any exposed instance.

Root Cause

The root cause is uncontrolled resource consumption [CWE-770] in the multipart parser. The upload handler does not validate or cap the size of the boundary token before entering its per-character processing loop. Legitimate multipart boundaries are short — typically fewer than 70 characters per RFC 2046 — but the parser accepts arbitrarily long values.

Attack Vector

Exploitation occurs over the network against the file upload endpoint. An attacker crafts a POST request with a Content-Type: multipart/form-data; boundary=<very long string> header, where the boundary contains an oversized character sequence. Submitting the request forces ChuanhuChatGPT into a prolonged processing loop, exhausting worker threads or CPU cycles. Repeated or parallel requests amplify the impact, extending service unavailability. No authentication, no privileges, and no user interaction are required.

No verified public exploit code is available. See the Huntr bounty report for additional technical details.

Detection Methods for CVE-2024-7807

Indicators of Compromise

Inbound HTTP requests with abnormally long Content-Type boundary parameters, particularly beyond a few hundred bytes.
Sudden CPU saturation on the ChuanhuChatGPT process coinciding with POST requests to file upload paths.
Sharp drop in request throughput or increase in request latency for the ChuanhuChatGPT service.
Web server or reverse proxy logs showing repeated multipart uploads from a single source IP.

Detection Strategies

Inspect HTTP request headers at the proxy or WAF layer and alert on multipart boundary values exceeding 70 characters.
Correlate application CPU spikes with concurrent upload requests using process and request telemetry.
Baseline normal upload request duration and flag statistical outliers indicating parser stalls.

Monitoring Recommendations

Enable verbose logging on the ChuanhuChatGPT frontend proxy to capture full Content-Type header values.
Monitor process-level CPU and thread counts for the Python service hosting ChuanhuChatGPT.
Track HTTP 5xx rates and connection timeouts against the upload endpoint as availability signals.

How to Mitigate CVE-2024-7807

Immediate Actions Required

Update ChuanhuChatGPT to a build containing commit 919222d, which addresses the boundary handling issue.
Restrict network exposure of the ChuanhuChatGPT upload endpoint to trusted users and networks until the patch is applied.
Deploy a reverse proxy or WAF rule that rejects multipart requests with excessively long boundary parameters.

Patch Information

The upstream fix is available in the project repository via GitHub commit 919222d. Operators running version 20240628 should pull the latest revision and redeploy. Additional vulnerability context is documented in the Huntr bounty report.

Workarounds

Place ChuanhuChatGPT behind an authenticating reverse proxy so only known users can reach the upload endpoint.
Configure Nginx, HAProxy, or a WAF to enforce a maximum header length and drop requests with oversized Content-Type values.
Apply per-source rate limiting on the upload path to reduce the impact of repeated malicious requests.
Run the service under a process supervisor with CPU and memory quotas to contain resource exhaustion.

bash

# Example Nginx snippet to bound request header size and rate-limit uploads
http {
    large_client_header_buffers 4 8k;
    client_header_buffer_size 4k;

    limit_req_zone $binary_remote_addr zone=chuanhu_upload:10m rate=5r/m;

    server {
        location /file-upload {
            limit_req zone=chuanhu_upload burst=2 nodelay;
            proxy_pass http://chuanhuchatgpt_upstream;
        }
    }
}