{"id":"CVE-2024-27564","aliases":["EUVD-2024-24759","GHSA-xm2p-hxq8-xj3q"],"status":"published","title":"A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows...","description":"pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.40637,"percentile":0.98671,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-918"],"published":"2024-03-05T00:00:00Z","modified":"2026-10-28T02:30:44Z","exploits":[{"source":"nuclei","id":"CVE-2024-27564","title":"ChatGPT个人专用版 - Server Side Request Forgery","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27564.yaml"},{"source":"pocgithub","id":"babydessy/CVE-2024-27564","title":"babydessy/CVE-2024-27564","date":"2024-10-30","url":"https://github.com/babydessy/CVE-2024-27564"},{"source":"pocgithub","id":"chaudhrymuhammadtayab/SSRF-Exploit-CVE-2024-27564","title":"chaudhrymuhammadtayab/SSRF-Exploit-CVE-2024-27564","date":"2024-10-05","url":"https://github.com/chaudhrymuhammadtayab/SSRF-Exploit-CVE-2024-27564"}],"products":[{"vendor":"dirk1983","product":"chatgpt"},{"vendor":"dirk1983","product":"mm1.ltd source code"}],"references":[{"url":"https://github.com/dirk1983/chatgpt/issues/114","tags":["x_transferred","Exploit","Issue Tracking","Mitigation","Vendor Advisory","report"]},{"url":"https://web.archive.org/save/https://github.com/dirk1983/chatgpt/issues/114","tags":["web"]},{"url":"https://web.archive.org/web/20250320032559/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/pictureproxy.php","tags":["web"]},{"url":"https://web.archive.org/web/20250320031248/https://mm1.ltd/","tags":["web"]},{"url":"https://web.archive.org/save/https://github.com/dirk1983/chatgpt/blob/f9f4bbc99eed7210b291ec116bd57b3d8276bee5/README.md","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27564","tags":["advisory"]},{"url":"https://web.archive.org/web/20250320031248/https://mm1.ltd"},{"url":"https://github.com/advisories/GHSA-xm2p-hxq8-xj3q"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27564.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-27564","description":"pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2025-03-20T14:28:44.751Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:34:12.982241Z"}],"euvd":[{"id":"EUVD-2024-24759","description":"pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2025-03-20T14:28:44Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:57.796612Z"}],"ghsa":[{"id":"GHSA-xm2p-hxq8-xj3q","title":"A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows...","description":"A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter.","status":"published","published":"2024-03-05T18:31:13Z","modified":"2025-03-20T06:32:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:00:22.529672Z"}],"nvd":[{"id":"CVE-2024-27564","description":"pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.","status":"published","published":"2024-03-05T17:15:06.997Z","modified":"2026-06-17T07:20:02.23Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:09:39.488031Z"}],"osv":[{"id":"CVE-2024-27564","description":"pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. NOTE: the references section has an archived copy of pictureproxy.php from its original GitHub location, but the repository name might later change because it is misleading.","status":"published","published":"2024-03-05T00:00:00Z","modified":"2026-10-28T02:30:44.673326956Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:39.569658Z"}]}}