CVE-2024-31224: Insufficient Information (NVD-CWE-noinfo)
value: GPT Academic provides interactive interfaces for large language models. A vulnerability was found in gpt_academic versions 3.64 through 3.73. The server deserializes untrustworthy data from the client, which may risk remote code execution. Any device that exposes the GPT Academic service to the Internet is vulnerable. Version 3.74 contains a patch for the issue. There are no known workarounds aside from upgrading to a patched version.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-08T16:15Z
Repository: https://github.com/binary-husky/gpt_academic
Language: Python
Files changed: themes/theme.py
Commit date: 2024-03-25 09:54:30 +0800
Commit message: Qhaoduoyu patch 1: pickle to json to increase security (#1648)

* Update theme.py

fix bugs

* Update theme.py

fix bugs

* change var names

---------

Co-authored-by: binary-husky <qingxu.fu@outlook.com>
Diff: diff --git a/themes/theme.py b/themes/theme.py
index 6bbe4f0..b53af3a 100644
--- a/themes/theme.py
+++ b/themes/theme.py
@@ -1,9 +1,12 @@
 import pickle
 import base64
 import uuid
+import json
 from toolbox import get_conf
+import json
+
 
 """
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 第 1 部分
 加载主题相关的工具函数
@@ -43,28 +46,28 @@ adjust_theme, advanced_css, theme_declaration, _ = load_dynamic_theme(get_conf("
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 第 2 部分
 cookie相关工具函数
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 """
-
 def init_cookie(cookies):
     # 为每一位访问的用户赋予一个独一无二的uuid编码
     cookies.update({"uuid": uuid.uuid4()})
     return cookies
 
 
 def to_cookie_str(d):
-    # Pickle the dictionary and encode it as a string
-    pickled_dict = pickle.dumps(d)
-    cookie_value = base64.b64encode(pickled_dict).decode("utf-8")
+    # serialize the dictionary and encode it as a string
+    serialized_dict = json.dumps(d)
+    cookie_value = base64.b64encode(serialized_dict.encode('utf8')).decode("utf-8")
     return cookie_value
 
 
 def from_cookie_str(c):
-    # Decode the base64-encoded string and unpickle it into a dictionary
-    pickled_dict = base64.b64decode(c.encode("utf-8"))
-    return pickle.loads(pickled_dict)
+    # Decode the base64-encoded string and unserialize it into a dictionary
+    serialized_dict = base64.b64decode(c.encode("utf-8"))
+    serialized_dict.decode("utf-8")
+    return json.loads(serialized_dict)
 
 
 """
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 第 3 部分

Vulnerable code: 
    # Pickle the dictionary and encode it as a string
    pickled_dict = pickle.dumps(d)
    cookie_value = base64.b64encode(pickled_dict).decode("utf-8")
    # Decode the base64-encoded string and unpickle it into a dictionary
    pickled_dict = base64.b64decode(c.encode("utf-8"))
    return pickle.loads(pickled_dict)
Fixed code: import json
import json

    # serialize the dictionary and encode it as a string
    serialized_dict = json.dumps(d)
    cookie_value = base64.b64encode(serialized_dict.encode('utf8')).decode("utf-8")
    # Decode the base64-encoded string and unserialize it into a dictionary
    serialized_dict = base64.b64decode(c.encode("utf-8"))
    serialized_dict.decode("utf-8")
    return json.loads(serialized_dict)