Auth bypass in Chuanhuchatgpt Project
CVE-2023-34094
ChuanhuChatGPT is a graphical user interface for ChatGPT and many large language models. A vulnerability in versions 20230526 and prior allows unauthorized access to the config.json file of the privately deployed ChuanghuChatGPT project, when authentication is not configured. The attacker can exploit this vulnerability to steal the API keys in the configuration file. The vulnerability has been fixed in commit bfac445. As a workaround, setting up access authentication can help mitigate the vulnerability.
Vulnerability class: Information Disclosure
EPSS: 0.006 (47.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Chuanhuchatgpt_project Chuanhuchatgpt
- Gaizhenbiao Chuanhuchatgpt — versions <= 20230526
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-34094?
- CVE-2023-34094 is a high-severity vulnerability in Chuanhuchatgpt Project, classified under Information Disclosure. CVSS score: 7.5/10. Published 2023-06-02.
- How severe is CVE-2023-34094?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-34094 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.