gaizhenbiao chuanhuchatgpt Regular Expression Denial-of-Service Vulnerability

A Regular Expression Denial of Service (ReDoS) vulnerability has been identified in gaizhenbiao/chuanhuchatgpt, specifically in commit 20b2e02. The issue arises because the server employs a regex pattern to parse user input, which can lead to significant CPU consumption when processing certain crafted inputs. An attacker can exploit this vulnerability by uploading a malicious JSON payload, causing the server to use 100% of its CPU for an extended period. This resource exhaustion can disrupt the application's performance, particularly for the user who uploaded the payload, although it may not affect other users immediately.

Impact

Exploitation of this vulnerability leads to excessive CPU usage, causing the application to become unresponsive for the user who uploaded the malicious payload. However, this does not disrupt the application's functionality for other users. If the payload is crafted to utilize multiple CPU cores, it can cause a more widespread denial-of-service condition.

Reproduction

To reproduce this vulnerability, upload a JSON file containing a crafted 'chatbot' entry with a large number of '<' characters. This can be done through the application's GUI by using the 'upload chat history' feature. Once the file is uploaded, the server's CPU usage will spike to 100%. For a more severe impact, the uploaded file can be referenced in a subsequent request that simulates normal application usage, effectively amplifying the CPU consumption.