107/68 Wednesday, March 19, 2025
Cybersecurity firm Veriti has reported CVE-2024-27564, a Server-Side Request Forgery (SSRF) vulnerability affecting an open-source ChatGPT version developed by a Chinese developer—a separate platform from OpenAI’s widely used ChatGPT. While categorized as a medium-severity issue, it has been actively exploited in real-world attacks, with 10,479 attempts recorded within a single week, all originating from a single malicious IP address. Notably, 35% of affected organizations lacked adequate protection due to misconfigured security systems, including Intrusion Prevention Systems (IPS), Web Application Firewalls (WAF), and traditional firewalls.
The attacks have impacted multiple countries, with the United States experiencing the highest attack rate at 33%, followed by Germany and Thailand, each accounting for 7% of cases. The financial sector—including banks and fintech companies—has been the primary target due to its reliance on AI and APIs. This SSRF vulnerability could allow attackers to access internal resources and sensitive data, posing security risks such as data breaches, unauthorized transactions, and reputational damage. Veriti researchers emphasized that no vulnerability is too small to be exploited, especially in high-value organizations.
To mitigate the risk, Veriti recommends that organizations review and update their IPS, WAF, and firewall configurations to ensure effective protection. Additionally, security teams should monitor logs for attack attempts from malicious IP addresses and enhance security measures for AI and API integrations. Organizations should not solely rely on severity classifications when assessing risks, as cyber threats continuously evolve, and even minor vulnerabilities can lead to severe attacks if left unaddressed.
Source https://hackread.com/hackers-exploit-chatgpt-cve-2024-27564-10000-attacks/
