dirk1983/chatgpt - RCE (CVE-2024-27564)
201Exploiting IPs reported
A Server-Side Request Forgery (SSRF) in pictureproxy.php of dirk1983/chatgpt commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter.
CrowdSec analysis
CVE-2024-27564 is a Server-Side Request Forgery (SSRF) vulnerability in the picture proxy functionality of certain web applications, enabling attackers to coerce the server into making arbitrary web requests by manipulating image retrieval URLs.
CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-27564 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec network telemetry also shows that exploitation of CVE-2024-27564 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.
Exploitation attempts are characterized by access to URLs containing /pictureproxy.php?url=file://.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.