CVE-2024-12391

A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The function '解析项目源码（手动指定和筛选源码文件类型）' permits the execution of user-provided regular expressions. Certain regular expressions can cause the Python RE engine to take exponential time to execute, leading to a Denial of Service (DoS) condition. An attacker who controls both the regular expression and the search string can exploit this vulnerability to hang the server for an arbitrary amount of time.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://huntr.com/bounties/70b3f4f0-6b1b-4563-a18c-fe46502e6ba0	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:binary-husky:gpt_academic:2024-10-15:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-20 10:15

Updated : 2025-10-15 13:15

NVD link : CVE-2024-12391

Mitre link : CVE-2024-12391

CVE.ORG link : CVE-2024-12391

JSON object : View

Products Affected

binary-husky

gpt_academic

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2024-12391", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-03-20T10:15:28.510", "references": [{"url": "https://huntr.com/bounties/70b3f4f0-6b1b-4563-a18c-fe46502e6ba0", "tags": ["Exploit", "Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in binary-husky/gpt_academic, as of commit 310122f, allows for a Regular Expression Denial of Service (ReDoS) attack. The function '\u89e3\u6790\u9879\u76ee\u6e90\u7801\uff08\u624b\u52a8\u6307\u5b9a\u548c\u7b5b\u9009\u6e90\u7801\u6587\u4ef6\u7c7b\u578b\uff09' permits the execution of user-provided regular expressions. Certain regular expressions can cause the Python RE engine to take exponential time to execute, leading to a Denial of Service (DoS) condition. An attacker who controls both the regular expression and the search string can exploit this vulnerability to hang the server for an arbitrary amount of time."}, {"lang": "es", "value": "Una vulnerabilidad en binary-husky/gpt_academic, a partir de la confirmaci\u00f3n 310122f, permite un ataque de denegaci\u00f3n de servicio mediante expresiones regulares (ReDoS). La funci\u00f3n '?????????????????????' permite la ejecuci\u00f3n de expresiones regulares proporcionadas por el usuario. Ciertas expresiones regulares pueden provocar que el motor de Python RE tarde exponencialmente en ejecutarse, lo que provoca una denegaci\u00f3n de servicio (DoS). Un atacante que controle tanto la expresi\u00f3n regular como la cadena de b\u00fasqueda puede explotar esta vulnerabilidad para bloquear el servidor durante un tiempo arbitrario."}], "lastModified": "2025-10-15T13:15:40.393", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:binary-husky:gpt_academic:2024-10-15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B6DCF58-F2C2-4491-92A8-BAC81C60A9A4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}