GPT-Load Proxy Key Exposure via Cleartext Logging

Executive Summary

GPT-Load through version 1.4.11 has a cleartext logging vulnerability where the Gin Logger middleware records the raw query string of requests before authentication middleware removes the proxy key parameter. This exposes client proxy keys in console logs or ./data/logs/app.log files.

Useful 0 Not Useful 0

Detection Guidance

Check logs for raw query strings containing proxy keys. Search ./data/logs/app.log and console output for URLs with key parameters. Use commands like grep -r 'key=' ./data/logs/ or tail -f ./data/logs/app.log to monitor logs in real-time.

Useful 0 Not Useful 0

Impact Analysis

Attackers with access to logs can extract proxy keys and misuse them against the associated group until the key is rotated. This requires local log access but does not lead to remote code execution or host compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for protecting sensitive authentication credentials (proxy keys) under GDPR and HIPAA, as it involves unauthorized exposure of credentials in log files.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to GPT-Load v2.0 or later which removes the vulnerable code path. If upgrading is not possible, disable the Gin Logger middleware or filter out key parameters from logs. Rotate all exposed proxy keys immediately.

Useful 0 Not Useful 0