CVE-2024-32965: SSRF in @lobehub/chat

The SSRF vulnerability in @lobehub/chat poses a significant risk because it bypasses authentication controls. An attacker can leverage this to send requests to internal services that are not directly accessible from the outside world. This could involve accessing sensitive data stored on internal servers, interacting with internal APIs, or even triggering actions on other systems within the network. The potential blast radius extends to any internal resource accessible via HTTP or HTTPS, making it crucial to address this vulnerability promptly. The ability to bypass authentication significantly increases the impact, as it removes a common barrier to entry for attackers.

1. Reserved2024-04-22
2. Published2024-11-26
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-32965 is to immediately upgrade @lobehub/chat to version 1.19.13 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) to filter outbound requests and block those targeting internal IP addresses or sensitive endpoints. Additionally, restrict network access to the @lobehub/chat instance to only authorized users and systems. Monitor logs for unusual outbound requests originating from the application, specifically looking for requests to internal IP addresses. No specific Sigma or YARA rules are readily available, but custom rules can be created to detect requests to internal networks.