FastChat - Open Redirect

mediumseverity

0.8%likelihood of exploitation, next 30 days

57%of all CVEs are less likely

Readycheck to confirm it

Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs.

Impact

Unauthenticated attackers can redirect users to malicious URLs, potentially facilitating phishing attacks or credential harvesting.

Fix

Update FastChat to a version newer than 0.2.36.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains_any(body,"lm-sys/FastChat/")
Send: GET {{BaseURL}}/file=https://interact.sh
Positive when: matches in header /(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$/

Run it with nuclei: nuclei -id CVE-2024-10908 -u <target>

The full check

id: CVE-2024-10908

info:
  name: FastChat - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs.
  impact: |
    Unauthenticated attackers can redirect users to malicious URLs, potentially facilitating phishing attacks or credential harvesting.
  remediation: |
    Update FastChat to a version newer than 0.2.36.
  reference:
    - https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2
  classification:
    epss-score: 0.00784
    epss-percentile: 0.56382
  metadata:
    shodan-query: html:"Chatbot Arena"
    verified: true
    max-request: 1
  tags: cve,cve2024,fastchat,redirect,oss,chatbot,areana,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body,"lm-sys/FastChat/")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/file=https://interact.sh"

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'

References

https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2

Use this check only on systems you are authorised to test. Where the data comes from