Vulnerability · Published Sep 23, 2024 · Assigned by GitHub_M

CVE-2024-47066Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

Critical 9.0

In plain English

A critical-severity server-side request forgery in lobe-chat from lobehub. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 11.9% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)11.9%top 3.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@lobehub/chat	1.19.13	GHSA-3fc8-2r3f-8wrg

Affected products (as reported)

Vendor	Product	Versions
lobehub	lobe-chat	< 1.19.13

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

References

https://github.com/lobehub/lobe-chat/security/advisories/GHSA-3fc8-2r3f-8wrg x_refsource_CONFIRM
https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc x_refsource_MISC
https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf x_refsource_MISC
https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts x_refsource_MISC