AWS | Self Registration Internal LibreChat : Access to internal/proprietary LLMs

How it was found

Issue Summary

A LibreChat endpoint/UI is found to be accessible to the public Internet, with self registration (for any non AWS/Amazon Corporate domains) enabled, allowing an attacker to use a ChatGPT like UI to access multiple public models (Example : Claude) with the API access it has enabled, as well as Amazon Titan Foundation Models (Premier, Express and Lite).

Endpoint

███

$ dig  +short ██████
███
█████████

Steps To Reproduce

Navigate to ████████ and use the registration form to sign up to the service using any public email services (yopmail as an example).

Optionally, use the account created for this test : Email : ████████Password :██████████Username :█████████

Evidence

████████ ███████ ████ (Evidence of potential RCE, but requires LibreChat paid access. Details in Impact section). ███████

Impact

• Access public frontier models (Claude, Cohere Command, etc.) using the privileges (paid access) that is pre-configured.
• Access Amazon Titan Foundation Models (Premier, Express and Lite).
• Potentially get Remote Code Execution by means of Code Interpretation capabilities when creating a new agent. This requires a paid LibreChat access, and hence was not tested.