Lobe Chat Server-Side Request Forgery Vulnerability
CVE-2024-32964

9CRITICAL

Key Information:

Vendor

Lobehub

Status
Lobe-chat
Vendor
CVE Published:
14 May 2024

What is CVE-2024-32964?

The Lobe Chat framework, designed for chatbot development with capabilities like speech synthesis and a multimodal plugin system, has a vulnerability in its /api/proxy endpoint prior to version 0.150.6. This flaw allows attackers to execute unauthorized Server-Side Request Forgery, enabling them to craft malicious requests. Such exploits can compromise intranet services and potentially expose sensitive information without the need for authentication, posing a significant risk to users and systems relying on this framework.

Affected Version(s)

lobe-chat <= 0.150.5

References

https://github.com/lobehub/lobe-chat/security/advisories/...
x_refsource_CONFIRM
https://github.com/lobehub/lobe-chat/commit/465665a735556...
x_refsource_MISC

EPSS Score

23% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-32964 : Lobe Chat Server-Side Request Forgery Vulnerability