CVE-2024-2217

Name: CVE-2024-2217
Creator: NVD / NIST
Published: 2024-04-10T17:15:54.44+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.78%

Last modified Jun 17, 2026

CVE-2024-2217 is a vulnerability of currently unknown severity. gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. EPSS estimates a 0.78% chance of exploitation in the next 30 days.

Description

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication.

Metrics

EPSS Probability

0.78%

51.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-284

Affected Software

Vendor	Product	Versions
Gaizhenbiao	Chuanhuchatgpt	20240121

References

https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7dPatch
https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29Exploit, Third Party Advisory
https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7dPatch
https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29Exploit, Third Party Advisory

Timeline

Published: Apr 10, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-2217?

How severe is CVE-2024-2217?

Severity scoring for CVE-2024-2217 is pending analysis. The EPSS model estimates a 0.78% probability of exploitation in the next 30 days.

How do I fix CVE-2024-2217?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-2217?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST