@lobehub/chat Server Side Request Forgery vulnerability

The SSRF vulnerability in @lobehub/chat poses a significant risk because it bypasses authentication controls. An attacker can leverage this to send requests to internal services that are not directly accessible from the outside world. This could involve accessing sensitive data stored on internal servers, interacting with internal APIs, or even triggering actions on other systems within the network. The potential blast radius extends to any internal resource accessible via HTTP or HTTPS, making it crucial to address this vulnerability promptly. The ability to bypass authentication significantly increases the impact, as it removes a common barrier to entry for attackers.

Organizations using @lobehub/chat for local LLM experimentation or development are at risk, particularly those with sensitive internal services accessible via HTTP or HTTPS. Shared hosting environments where multiple users share the same @lobehub/chat instance are also at increased risk, as a compromised user could potentially exploit the SSRF vulnerability to access other users' data or internal resources.

• nodejs / server:

  ps aux | grep @lobehub/chat

• nodejs / server:

  npm list @lobehub/chat

• generic web: Review access logs for outbound requests to internal IP addresses (e.g., 127.0.0.1, 192.168.x.x, 10.x.x.x) originating from the @lobehub/chat application. • generic web: Monitor response headers for unexpected content or error messages indicating SSRF attempts.

1. 2024-11-26Disclosure

   disclosure

1. Reserviert2024-04-22
2. Veröffentlicht2024-11-26
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-32965 is to immediately upgrade @lobehub/chat to version 1.19.13 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) to filter outbound requests and block those targeting internal IP addresses or sensitive endpoints. Additionally, restrict network access to the @lobehub/chat instance to only authorized users and systems. Monitor logs for unusual outbound requests originating from the application, specifically looking for requests to internal IP addresses. No specific Sigma or YARA rules are readily available, but custom rules can be created to detect requests to internal networks.