CVE-2024-32965 ssrf vulnerability in lobe-chat
Unauthenticated attackers can exploit SSRF in Lobe Chat to scan internal networks and leak sensitive information by modifying proxy headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32965?
CVE-2024-32965 is a high-severity server-side request forgery vulnerability in lobehub lobe-chat, published on 26 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-918
Which versions are affected by CVE-2024-32965?
2 open source packages ship an affected version, including @lobehub/chat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@lobehub/chat npm | All versions | 1.19.13 |
@lobehub/chat npm | All versions | 1.19.13 |
Products include Lobehub Lobe Chat.
How do I fix CVE-2024-32965?
Upgrade @lobehub/chat to 1.19.13 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-32965 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32965 exists.
Other vulnerabilities in lobehub lobe-chat
- CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
- CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
- CVE-2025-59417 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
- CVE-2024-37895 API Key Leak in lobe-chat
- CVE-2024-24566 Lobe Chat unauthorized access to plugins
Sources
Also known as GHSA-2xcc-vm3f-m8rw.