Description
dirk1983/chatgpt 是一个用于构建私有化 ChatGPT 类服务的开源项目。该漏洞存在于 pictureproxy.php 文件中，由于未对用户输入的 URL 参数进行过滤，攻击者可以构造恶意请求读取系统文件或探测内网服务，导致敏感信息泄露。该漏洞可能对部署该项目的企业内网环境造成全局影响。
dirk1983/chatgpt /pictureproxy.php 文件读取漏洞（CVE-2024-27564）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-27564
https://github.com/dirk1983/chatgpt/issues/114
https://avd.aliyun.com/detail?id=AVD-2024-27564
https://cn-sec.com/archives/2607527.html
https://www.tenable.com/cve/CVE-2024-27564
https://www.sentinelone.com/vulnerability-database/cve-2024-27564/
https://hivepro.com/threat-advisory/cve-2024-27564-ssrf-vulnerability-puts-ai-integrated-systems-at-risk/
https://web.archive.org/web/20250320032559/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/pictureproxy.php