Chinese ChatGPT-clone (pictureproxy.php) SSRF exploited in the wild
Date: 2024-03
Affected: ChatGPT (open-source clone), commit f9f4bbc
Attack vector: ssrf
Category: real-world
Severity: Medium
CVE: CVE-2024-27564
CVSS: 6.5 ()

Server-side request forgery in an open-source ChatGPT clone's pictureproxy.php (insufficient url parameter validation -> arbitrary file_get_contents). Actively exploited against US financial/government orgs (Veriti reported 10,479 attacks in one week). Note: not OpenAI's ChatGPT product.


Mitigations:

Architectural layers (MAESTRO):