freegpt-webui CWE-362 Race Condition & State Corruption Exploit Chain

Key Vulnerability Information Summary Vulnerability Overview Vulnerability ID: #895269 Title: Submit #895269: ramon-victor (https://github.com/ramon-victor) freegpt-webui latest (main/master branch) CWE-362 (Race Condition / TOCTOU - non-atomic check-then-act wit Vulnerability Type: CWE-362 (Race Condition / TOCTOU - non-atomic check-then-act) Description: - Race Condition - Mutable Shared Global State (Module-Level Variables): Location: function in (around line 25). - The shared global function initializes special instructions/definitions in module-level variables and overwrites them on every request. - The states and perform a non-atomic check-then-act read: checking the current state, conceptualizing the two-response instructions, and writing the result to the shared state. - The read operations are lock-free, copy-free, and transaction-free. - Two Business Rules Are Broken: 1. Configuration should be immutable per request, but each request permanently extends ; concurrent requests can read and overwrite indefinitely, causing to be corrupted. 2. Accumulation effect: Each subsequent request (concurrent or sequential) reads the response of another request, passing the instruction to or , causing the response to be read and overwritten, resulting in the loss of state/context of the upstream model. - Exploitation Example: 1. The attacker sends with a JSON body containing or . 2. executes and for all users, permanently altering the state. 3. The attacker repeats the request N times (e.g., via a simple loop or concurrent requests). The stored state contains only N accumulated copies. 4. The attacker sends with a JSON body containing or . 5. The attacker sends with a JSON body containing or . 6. The attacker sends with a JSON body containing or . 7. The attacker sends with a JSON body containing or . 8. The attacker sends with a JSON body containing or . 9. The attacker sends with a JSON body containing or . 10. The attacker sends with a JSON body containing or . 11. The attacker sends with a JSON body containing or . 12. The attacker sends with a JSON body containing or . 13. The attacker sends with a JSON body containing or . 14. The attacker sends with a JSON body containing or . 15. The attacker sends with a JSON body containing or . 16. The attacker sends with a JSON body containing or . 17. The attacker sends with a JSON body containing or . 18. The attacker sends with a JSON body containing or . 19. The attacker sends with a JSON body containing or . 20. The attacker sends with a JSON body containing or . 21. The attacker sends with a JSON body containing or . 22. The attacker sends with a JSON body containing or . 23. The attacker sends with a JSON body containing or . 24. The attacker sends with a JSON body containing or . 25. The attacker sends with a JSON body containing or . 26. The attacker sends with a JSON body containing or . 27. The attacker sends with a JSON body containing or . 28. The attacker sends with a JSON body containing or . 29. The attacker sends with a JSON body containing or . 30. The attacker sends with a JSON body containing or . 31. The attacker sends with a JSON body containing or . 32. The attacker sends with a JSON body containing or . 33. The attacker sends with a JSON body containing or . 34. The attacker sends with a JSON body containing or . 35. The attacker sends with a JSON body containing or . 36. The attacker sends with a JSON body containing or . 37. The attacker sends with a JSON body containing or . 38. The attacker sends with a JSON body containing or . 39. The attacker sends with a JSON body containing or . 40. The attacker sends with a JSON body containing or . 41. The attacker sends with a JSON body containing or . 42. The attacker sends with a JSON body containing or . 43. The attacker sends with a JSON body containing or . 44. The attacker sends with a JSON body containing or . 45. The attacker sends with a JSON body containing or . 46. The attacker sends with a JSON body containing or . 47. The attacker sends with a JSON body containing or . 48. The attacker sends with a JSON body containing or . 49. The attacker sends with a JSON body containing or . 50. The attacker sends with a JSON body containing or . 51. The attacker sends with a JSON body containing or . 52. The attacker sends with a JSON body containing or . 53. The attacker sends with a JSON body containing or . 54. The attacker sends with a JSON body containing or . 55. The attacker sends with a JSON body containing or . 56. The attacker sends with a JSON body containing or . 57. The attacker sends with a JSON body containing or . 58. The attacker sends with a JSON body containing or . 59. The attacker sends with a JSON body containing or . 60. The attacker sends with a JSON body containing or . 61. The attacker sends with a JSON body containing or . 62. The attacker sends with a JSON body containing or . 63. The attacker sends with a JSON body containing or . 64. The attacker sends with a JSON bod

Goal Reached Thanks to every supporter — we hit 100%!

freegpt-webui CWE-362 Race Condition & State Corruption Exploit Chain

More from this source