CVE-2024-3403

imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/7431d1dd-f014-4d4f-acb6-f97369ef3688

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-16 09:15

Updated : 2024-05-16 13:03

NVD link : CVE-2024-3403

Mitre link : CVE-2024-3403

CVE.ORG link : CVE-2024-3403

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-3403", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-05-16T09:15:14.053", "references": [{"url": "https://huntr.com/bounties/7431d1dd-f014-4d4f-acb6-f97369ef3688", "source": "security@huntr.dev"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files."}, {"lang": "es", "value": "imartinez/privategpt versi\u00f3n 0.2.0 es vulnerable a una vulnerabilidad de inclusi\u00f3n de archivos local que permite a los atacantes leer archivos arbitrarios del sistema de archivos. Al manipular la funcionalidad de carga de archivos para ingerir archivos locales arbitrarios, los atacantes pueden explotar la funci\u00f3n \"Buscar en Documentos\" o consultar la IA para recuperar o revelar el contenido de cualquier archivo en el sistema. Esta vulnerabilidad podr\u00eda provocar varios impactos, que incluyen, entre otros, la ejecuci\u00f3n remota de c\u00f3digo mediante la obtenci\u00f3n de claves SSH privadas, el acceso no autorizado a archivos privados, la divulgaci\u00f3n del c\u00f3digo fuente que facilita m\u00e1s ataques y la exposici\u00f3n de archivos de configuraci\u00f3n."}], "lastModified": "2024-05-16T13:03:05.353", "sourceIdentifier": "security@huntr.dev"}