CVE-2024-10707 — UNKNOWN AI Security Vulnerability

CISO Take

Any self-hosted ChuanhuChatGPT instance is fully exposed: unauthenticated attackers can read arbitrary server files, including API keys for OpenAI/Anthropic stored in .env files. Patch immediately or take offline. Assume compromise and rotate all credentials on affected servers.

Risk Assessment

High risk for orgs self-hosting ChuanhuChatGPT. Zero authentication barrier plus network-accessible attack surface means any internet-exposed instance is trivially exploitable. The inherited Gradio CVE-2024-4941 suggests broad impact across Gradio-based ML UIs. Primary exposure: API key theft enabling secondary cloud resource abuse and lateral movement.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
chuanhuchatgpt	pip	—	No patch

Do you use chuanhuchatgpt? You're affected.

Severity & Risk

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Recommended Action

5 steps

Patch: Update chuanhuchatgpt to a version with patched gradio (>=5.9.1 per CVE-2024-4941).
If immediate patching is not possible, restrict access to trusted IPs via firewall/reverse proxy authentication.
Rotate all API keys stored on the server (OpenAI, Anthropic, cloud providers).
Review access logs for POST requests to dataset/upload endpoints containing path traversal patterns (../../).
Detection rule: alert on JSON uploads containing '../' sequences in file path fields.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Auth Bypass Framework API AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.9.1 - Information security controls for AI systems

NIST AI RMF

GOVERN-6.2 - Policies and procedures for AI system security

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2024-10707?

Any self-hosted ChuanhuChatGPT instance is fully exposed: unauthenticated attackers can read arbitrary server files, including API keys for OpenAI/Anthropic stored in .env files. Patch immediately or take offline. Assume compromise and rotate all credentials on affected servers.

Is CVE-2024-10707 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-10707, increasing the risk of exploitation.

How to fix CVE-2024-10707?

1. Patch: Update chuanhuchatgpt to a version with patched gradio (>=5.9.1 per CVE-2024-4941). 2. If immediate patching is not possible, restrict access to trusted IPs via firewall/reverse proxy authentication. 3. Rotate all API keys stored on the server (OpenAI, Anthropic, cloud providers). 4. Review access logs for POST requests to dataset/upload endpoints containing path traversal patterns (../../). 5. Detection rule: alert on JSON uploads containing '../' sequences in file path fields.

What systems are affected by CVE-2024-10707?

This vulnerability affects the following AI/ML architecture patterns: self-hosted LLM chat interfaces, Gradio-based ML UIs, AI development environments.

What is the CVSS score for CVE-2024-10707?

No CVSS score has been assigned yet.

Technical Details

NVD Description

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially crafted JSON file and exploiting the improper input validation in the handle_dataset_selection function.

Exploitation Scenario

Attacker discovers a ChuanhuChatGPT instance via Shodan (port 7860, typical Gradio default) or a shared URL. Without any authentication, they upload a crafted JSON file to the dataset selection endpoint where the file path references ../../../.env or /proc/self/environ. The server returns file contents, exposing the operator's OpenAI API key. Attacker uses the key for their own LLM usage or sells it while the victim incurs charges. Total time to exploit: under 5 minutes with no specialized knowledge.