TI-2024-04760 Aliases CVE-2024-5124 GHSA-xgqc-3vhw-cphp

Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt

HIGH 74CWE-203Published 2024-06-06 · Updated 2025-05-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-203.

Summary

A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Python. This method of comparison allows an attacker to guess passwords based on the timing of each character's comparison. The issue arises from the code segment that checks a password for a particular username, which can lead to the exposure of sensitive information to an unauthorized actor. An attacker exploiting this vulnerability could potentially guess user passwords, compromising the security of the system.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01411 72nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed gaizhenbiao/chuanhuchatgpt (gaizhenbiao): 20240628

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gaizhenbiao	gaizhenbiao/chuanhuchatgpt	before 20240628	20240628	Patch available	CNA

gaizhenbiao/chuanhuchatgpt Vendorgaizhenbiao Affected before 20240628 Fixed in 20240628 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gaizhenbiao:chuanhuchatgpt::::::::	before 20240628	Vulnerable	gaizhenbiao

cpe:2.3:a:gaizhenbiao:chuanhuchatgpt:*:*:*:*:*:*:*:* Versions before 20240628 Vulnerable ·gaizhenbiao

Remediation

Fix · CNA gaizhenbiao/chuanhuchatgpt (gaizhenbiao) Fixed in 20240628

Timeline

2026-10-02 Threatist record created from CVE-2024-5124
2026-10-03 Alias added: GHSA-xgqc-3vhw-cphp

References

Exploit 1

https://huntr.com/bounties/e85ec077-930a-4597-975f-9341d2805641

Other 1

https://github.com/gaizhenbiao/chuanhuchatgpt/commit/e46ec4ecd896bc3c88eb9a2f44e8593f3c6761b4

TI-2024-03032 Path Traversal in gaizhenbiao/chuanhuchatgpt CVSS 3.1CRITICAL 9.8
TI-2024-05543 Path Traversal in gaizhenbiao/chuanhuchatgpt CVSS 3.1CRITICAL 9.8
TI-2024-05399 Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPT CVSS 3.1CRITICAL 9.8
TI-2024-05802 Path Traversal in gaizhenbiao/chuanhuchatgpt CVSS 3.1CRITICAL 9.1
TI-2024-05594 Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt CVSS 3.1CRITICAL 9.1
TI-2024-05593 Denial of Service in gaizhenbiao/chuanhuchatgpt CVSS 3.1CRITICAL 9.1

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences