CVE-2024-48145
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Summary
A prompt injection vulnerability exists in the chatbox of Netangular Technologies ChatNet AI Version v1.0. This vulnerability allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant by sending a crafted message.
Impact
The impact of this vulnerability is severe. Attackers can gain unauthorized access to sensitive chat data, including both historical and future conversations between users and the AI assistant. This leads to a significant breach of confidentiality, potentially exposing private information, business secrets, or personal data shared during chat sessions. The vulnerability has a high impact on both confidentiality and availability, as indicated by the CVSS v3.1 score.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
As of the current information, there is no specific mention of an available patch. The affected software is Netangular Technologies ChatNet AI Version v1.0, and security teams should monitor for updates from the vendor.
Mitigation
While awaiting a patch, consider the following mitigation strategies: 1. Limit access to the ChatNet AI system to only trusted users and networks. 2. Implement strong input validation and sanitization for all user inputs in the chatbox. 3. Monitor chat logs for any suspicious activities or data exfiltration attempts. 4. If possible, temporarily disable the chatbox feature until a patch is available. 5. Educate users about the risks of sharing sensitive information through the chat system. 6. Implement additional logging and monitoring to detect potential exploit attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Timeline
NVD published the first details for CVE-2024-48145
Feedly found the first article mentioning CVE-2024-48145. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.04% (Percentile: 9.8%)
A CVSS base score of 9.1 has been assigned.
A CVSS base score of 9.1 has been assigned.