by Kastro
Paper/Archive/CVE-2024-6037

CVE-2024-6037

gaizhenbiao gaizhenbiao/chuanhuchatgpt — Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt

EPSS 11%public exploitCVSS 9.1
critical.is priorityof 100
57
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 95.8.958 × 2019.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server unavailability, and potential data loss or corruption.

Affected

ProductAffectedFixed inSource
gaizhenbiao/chuanhuchatgptunspecified – < 2024091820240918CNA
chuanhuchatgpt20240410–CISA-ADP

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
@huntr_ai (CNA)7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refhuntr.com/bounties/eca6904f-f9fd-40c8-9e85-96f54daf405erefgithub.com/gaizhenbiao/chuanhuchatgpt/commit/71cb89c4c948dae5aaa0ae64b98f98e3965bdb37