CVE-2024-5124
Gaizhenbiao Chuanhuchatgpt ≤ 20240628
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2024-5124 is a high-severity Observable Discrepancy (CWE-203) vulnerability in Gaizhenbiao Chuanhuchatgpt. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked in the top 30% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to IA-6 (Authentication Feedback) and SI-11 (Error Handling) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A timing attack vulnerability exists in version 20240310 of the gaizhenbiao/chuanhuchatgpt repository, where passwords are compared using Python's '=' operator during authentication checks for a given username. This approach enables observable differences in comparison timing that leak information about password contents, corresponding to CWE-203. The flaw received a CVSS 7.5 score reflecting network-exploitable conditions with high impact on confidentiality and no requirements for authentication or user interaction.
An unauthenticated remote attacker can exploit the vulnerability by measuring response times across repeated authentication attempts with crafted inputs, allowing incremental guessing of valid user passwords and potential unauthorized access to accounts.
The referenced GitHub commit e46ec4ecd896bc3c88eb9a2f44e8593f3c6761b4 implements a fix for the affected password comparison logic, while the associated huntr.com bounty report documents the issue and its remediation. The EPSS score has remained flat at 0.4613 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46381
Vulnerability Data
A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Python. This method of comparison allows…
more
an attacker to guess passwords based on the timing of each character's comparison. The issue arises from the code segment that checks a password for a particular username, which can lead to the exposure of sensitive information to an unauthorized actor. An attacker exploiting this vulnerability could potentially guess user passwords, compromising the security of the system.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- The vulnerability is in gaizhenbiao/chuanhuchatgpt, an open-source ChatGPT-like web UI and assistant interface for LLMs such as OpenAI and others, listed on an AI/ML bug bounty platform (huntr).
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Obscures authentication feedback so that success/failure differences are not observable to attackers.
Requires error messages to avoid revealing exploitable details, directly stopping observable response discrepancies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent observable response discrepancies via consistent error handling and timing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Accurate, synchronized timestamps reduce observable timing discrepancies that an attacker could exploit to infer sensitive information or distinguish between success and failure paths.