CVE-2024-6037CWE-770

Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt

High · published July 10, 2024

CVSS v3.0
7.5
EPSS
11%
Percentile
95.8
In the wild
Unconfirmed
What it is

⚡ An attacker can create folders anywhere on the server, even in the root directory! Think of it as someone getting a key to the server’s storage room and leaving junk everywhere. 🔥 Imagine a restaurant with an open kitchen policy where anyone can come in and start piling up boxes in the storage area. The chef can't find the ingredients anymore, leading to chaos and delays in serving customers. This vulnerability is just like that, creating unorganized folders that waste server resources and could cause a complete shutdown. This could lead to uncontrolled resource consumption, resulting in a denial of service (DoS) where your server becomes sluggish or even completely unavailable. If the server runs out of resources, it might corrupt or even lose data, leaving you with a potential disaster on your hands!

Put simply

Imagine a restaurant with an open kitchen policy where anyone can come in and start piling up boxes in the storage area. The chef can't find the ingredients anymore, leading to chaos and delays in serving customers. This vulnerability is just like that, creating unorganized folders that waste server resources and could cause a complete shutdown. This vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an authenticated attacker to create arbitrary folders anywhere on the server, which can lead to severe resource exhaustion and service downtime.

What to do

This could lead to uncontrolled resource consumption, resulting in a denial of service (DoS) where your server becomes sluggish or even completely unavailable. If the server runs out of resources, it might corrupt or even lose data, leaving you with a potential disaster on your hands! To remediate this, update to the latest version of gaizhenbiao/chuanhuchatgpt that addresses this issue. Implement strict folder creation permissions and monitor server resource usage to prevent potential abuse. Make sure to audit existing folder structures to clean up any unauthorized additions. You've got this! Follow these steps and you'll protect your server like a true security hero! 🛡️

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.10693 · 95.8th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-07-10T22:43Z
EPSS history
Timeline
  • 10 JUL 22:43Z
    Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt
    cvelistv5