CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-47066 – Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
https://notcve.org/view.php?id=CVE-2024-47066
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue. • https://github.com/l8BL/CVE-2024-47066 https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf https://github.com/lobehub/lobe-chat/security/advisories/GHSA-3fc8-2r3f-8wrg https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37895 – API Key Leak in lobe-chat
https://notcve.org/view.php?id=CVE-2024-37895
Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability. • https://github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32964 – lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
https://notcve.org/view.php?id=CVE-2024-32964
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information. Lobe Chat es un framework de chatbot que admite síntesis de voz, sistema de complemento de llamada de función multimodal y extensible. Antes de la versión 0.150.6, lobe-chat tenía una vulnerabilidad de Server Side Request Forgery no autorizada en el endpoint /api/proxy. • https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37 https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2024-24566 – Lobe Chat unauthorized access to plugins
https://notcve.org/view.php?id=CVE-2024-24566
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4. Lobe Chat es un framework de chatbot que admite síntesis de voz, sistema de complemento de llamada de función multimodal y extensible. Cuando la aplicación está protegida con contraseña (implementada con la opción `ACCESS_CODE`), es posible acceder a los complementos sin la autorización adecuada (sin contraseña). • https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37 • CWE-284: Improper Access Control •