CVE-2024-47066: SSRF in @lobehub/chat

The SSRF vulnerability in @lobehub/chat poses a significant risk. An attacker can exploit this flaw to send requests to internal resources that are otherwise inaccessible from the outside world. This could include accessing private network services, loopback addresses, or even internal APIs. Successful exploitation could lead to data exfiltration, unauthorized access to sensitive systems, and potentially even complete compromise of the underlying infrastructure. The ability to redirect requests allows bypassing of intended security controls, expanding the attack surface considerably.

1. Reserved2024-09-17
2. Published2024-09-23
3. Modified2026-02-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-47066 is to upgrade to version 1.19.13 or later of the @lobehub/chat component. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter out potentially malicious URLs containing redirects. Specifically, configure the WAF to block requests containing redirect headers or suspicious URL patterns. Thoroughly review and validate all external URLs before processing them within the application. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and verifying that the request is blocked.