Springboot-OpenAI-ChatGPT Improper Access Control Vulnerability in Chat History Deletion

An access control vulnerability has been identified in the Springboot-OpenAI-ChatGPT application, specifically in version e84f6f5. The issue arises in the Chat History Handler component, within the deleteChat function of the API endpoint /api/mjkj-chat/chat/ai/delete/chat. The vulnerability allows users to delete another user's chat history by manipulating the chatListId parameter, leading to unauthorized deletion of chat records. This vulnerability can be exploited remotely and has been publicly disclosed, with a proof-of-concept exploit available.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of users' chat history, potentially leading to loss of important conversational data.

Reproduction

To reproduce this vulnerability, two users with different access tokens are needed: an 'attacker' and a 'victim'. The attacker can delete the victim's chat history by sending a request to the deleteChat API endpoint with the victim's chatListId. This action will result in the deletion of the victim's chat history, demonstrating the improper access control.