CVE-2024-3403: Local File Inclusion in imartinez/privategpt
imartinez/privategpt version 0.2.0 is vulnerable to a local file inclusion vulnerability that allows attackers to read arbitrary files from the filesystem. By manipulating file upload functionality to ingest arbitrary local files, attackers can exploit the 'Search in Docs' feature or query the AI to retrieve or disclose the contents of any file on the system. This vulnerability could lead to various impacts, including but not limited to remote code execution by obtaining private SSH keys, unauthorized access to private files, source code disclosure facilitating further attacks, and exposure of configuration files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3403?
CVE-2024-3403 is classified as a high-severity vulnerability due to its potential for arbitrary file reading.
How do I fix CVE-2024-3403?
To remediate CVE-2024-3403, ensure that file upload functionalities only allow specific file types and sanitize all input.
What types of attacks can CVE-2024-3403 enable?
CVE-2024-3403 can enable attackers to read sensitive files on the filesystem, leading to information leakage.
Which versions of privategpt are affected by CVE-2024-3403?
CVE-2024-3403 affects version 0.2.0 of imartinez/privategpt.
How does the local file inclusion vulnerability in CVE-2024-3403 work?
The local file inclusion vulnerability in CVE-2024-3403 allows attackers to exploit the 'Search in Docs' feature to read arbitrary files by manipulating the file upload process.