« Volver al listado

CVE-2024-11039

Estado: AnalizadaAlta (8.8)—

A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Deserialización de pickle no autenticada en servicio remoto (PR:L sugiere acceso autenticado pero vulnerable a RCE). Impacto: ejecución de comandos arbitrarios mediante numpy gadget chain; potencial escalada si se ejecuta con privilegios elevados.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramPrivileged Account ManagementExecution PreventionDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Binary-husky — GPT Academic

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-11039",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-11039",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-20T17:50:02.153977Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "binary-husky",
          "product": "binary-husky/gpt_academic",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "91f5e6b",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-03-20T10:15:23.170",
  "references": [
    {
      "url": "https://github.com/binary-husky/gpt_academic/commit/91f5e6b8f754beb47b02f7c1893804c1c9543ccb",
      "tags": [
        "Patch"
      ],
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/f233a365-522c-44f6-876f-db492fb58ad5",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@huntr.dev"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including 3.83. This vulnerability allows attackers to achieve remote command execution by deserializing untrusted data. The issue arises from the inclusion of numpy in the deserialization whitelist, which can be exploited by constructing a malicious compressed package containing a merge_result.pkl file and a merge_proofread_en.tex file. The vulnerability is fixed in commit 91f5e6b."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de deserialización de pickle en la función del complemento de corrección de errores de Latex English de las versiones binary-husky/gpt_academic hasta la 3.83 incluida. Esta vulnerabilidad permite a los atacantes ejecutar comandos de forma remota deserializando datos no confiables. El problema surge de la inclusión de numpy en la lista blanca de deserialización, que puede explotarse mediante la creación de un paquete comprimido malicioso que contenga los archivos merge_result.pkl y merge_proofread_en.tex. La vulnerabilidad está corregida en el commit 91f5e6b."
    }
  ],
  "lastModified": "2026-06-17T06:56:56.200",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:binary-husky:gpt_academic:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C88F50B-CBEC-4CEE-BA94-B7CE7527DE05",
              "versionEndExcluding": "3.91"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@huntr.dev"
}