CVE-2024-32964

lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Severity Score

9.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

Lobe Chat es un framework de chatbot que admite síntesis de voz, sistema de complemento de llamada de función multimodal y extensible. Antes de la versión 0.150.6, lobe-chat tenía una vulnerabilidad de Server Side Request Forgery no autorizada en el endpoint /api/proxy. Un atacante puede crear solicitudes maliciosas para provocar una Server Side Request Forgery sin iniciar sesión, atacar servicios de intranet y filtrar información confidencial.

*Credits: N/A

CVSS Scores

GitHubv3.1 9.0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

Poc

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-04-22 CVE Reserved
2024-05-10 CVE Published
2024-08-02 CVE Updated
2024-10-06 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-918: Server-Side Request Forgery (SSRF)

CAPEC

References (2)

URL	Tag	Source
https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37	X_refsource_misc
https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Lobehub Search vendor "Lobehub"		Lobe-chat Search vendor "Lobehub" for product "Lobe-chat"				<= 0.150.5 Search vendor "Lobehub" for product "Lobe-chat" and version " <= 0.150.5"		en		Affected