CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Critical 9.0 Published 10 May 2024 Updated 2 Aug 2024

An attacker can exploit an unauthorized SSRF vulnerability in the /api/proxy endpoint to access intranet services and leak sensitive information.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-32964?

CVE-2024-32964 is a critical server-side request forgery vulnerability in lobehub lobe-chat, published on 10 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

Weakness: CWE-918

Which versions are affected by CVE-2024-32964?

2 open source packages ship an affected version, including @lobehub/chat. It affects 1 product.

Package	Affected	Fixed in
`@lobehub/chat` npm	All versions	`0.150.6`
`@lobehub/chat` npm	All versions	`0.150.6`

Products include Lobehub Lobe Chat.

How do I fix CVE-2024-32964?

Upgrade @lobehub/chat to 0.150.6 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-32964 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32964 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-mxhq-xw3g-rphc.