Platform
nodejs
Component
@lobehub/chat
Fixed in
0.150.6
0.150.6
CVE-2024-32964 describes a critical Server-Side Request Forgery (SSRF) vulnerability discovered in the @lobehub/chat component, specifically affecting versions before 0.150.6. This flaw allows attackers to craft malicious requests, bypassing authentication and potentially accessing internal services. The vulnerability is located in the /api/proxy endpoint, enabling unauthorized data retrieval and manipulation. A fix is available in version 0.150.6.
The SSRF vulnerability in @lobehub/chat poses a significant risk. Attackers can leverage this to bypass access controls and directly interact with internal services that are not intended to be publicly accessible. This could lead to the exposure of sensitive data, including API keys, database credentials, or other confidential information residing within the internal network. The /api/proxy endpoint acts as a conduit, allowing attackers to redirect requests to arbitrary internal resources. Successful exploitation could result in unauthorized data modification, system compromise, and potential lateral movement within the affected environment.
This vulnerability was publicly disclosed on 2024-05-10. A public proof-of-concept demonstrating the SSRF exploitation is available on GitHub. The EPSS score is likely to be medium, given the ease of exploitation and potential impact. No confirmed active exploitation campaigns have been reported at the time of this writing, but the availability of a public PoC increases the likelihood of future exploitation.
Exploit Status
EPSS
72.72% (99% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2024-32964 is to immediately upgrade to @lobehub/chat version 0.150.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. Restrict access to the /api/proxy endpoint using a Web Application Firewall (WAF) or proxy server, allowing only trusted origins. Implement strict input validation on all requests to the /api/proxy endpoint to prevent malicious URL manipulation. Monitor network traffic for suspicious outbound requests originating from the @lobehub/chat component.
Update Lobe Chat to version 0.150.6 or higher. This version fixes the Server-Side Request Forgery (SSRF) vulnerability in the `/api/proxy` endpoint. The update will prevent attackers from making unauthorized requests to internal services and accessing sensitive information.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-32964 is a critical SSRF vulnerability affecting @lobehub/chat versions before 0.150.6, allowing attackers to access internal services and leak sensitive information.
You are affected if you are using @lobehub/chat versions prior to 0.150.6. Immediately check your dependencies and upgrade if necessary.
Upgrade to @lobehub/chat version 0.150.6 or later. As a temporary workaround, restrict access to the /api/proxy endpoint using a WAF or proxy server.
While no confirmed active exploitation campaigns have been reported, a public proof-of-concept exists, increasing the risk of exploitation.
Refer to the official @lobehub/chat GitHub repository for updates and advisories related to CVE-2024-32964: https://github.com/lobehub/lobe-chat
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.