CVE-2024-11031 Details
Description
In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() API. This vulnerability is exploited through the HotReload(Markdown翻译中) plugin function, which allows downloading arbitrary web hosts by only checking if the link starts with 'http'. Attackers can exploit this vulnerability to abuse the victim GPT Academic's Gradio Web server's credentials to access unauthorized web resources.
A Server-Side Request Forgery (SSRF) vulnerability has been identified in binary-husky gpt_academic version 3.83. The issue arises in the Markdown_Translate.get_files_from_everything() API, which is accessed through the HotReload(Markdown翻译中) plugin. This vulnerability allows attackers to download files from arbitrary web hosts by simply ensuring the link begins with 'http'. Exploitation of this flaw could lead to unauthorized access to web resources using the credentials of the victim's GPT Academic Gradio Web server.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/d27d89a7-7d54-45b9-a9eb-66c00bc56e02 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| binary-husky gpt academic | 3.83 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2025 | CVE Modified | [email protected] |
| Jul 14, 2025 | Initial Analysis | [email protected] |
| Mar 20, 2025 | New CVE Received | [email protected] |