CVE-2024-37895 – @lobehub/chat

Package

Manager: npm
Name: @lobehub/chat
Vulnerable Version: >=0 <0.162.25

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

EPSS: 0.00044 pctl0.12707

Details

Lobe Chat API Key Leak ### Summary If an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. ### Details The attack process is described above. ![image](https://github.com/lobehub/lobe-chat/assets/36695271/df5e0c3c-af28-45c3-959f-182cc9d06680) ### PoC Frontend: 1. Pass basic authentication (SSO/Access Code). 2. Set the Base URL to a private attack address. 3. Configure the request method to be a server-side request. 4. At the self-set attack address, retrieve the API Key information from the request headers. Backend: 1. The LobeChat version allows setting the Base URL. 2. There is no outbound traffic whitelist. ### Impact All community version LobeChat users using SSO/Access Code authentication, tested on version 0.162.13.

Metadata

Created: 2024-06-17T22:28:41Z
Modified: 2024-06-17T22:28:41Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-p36r-qxgx-jq2v/GHSA-p36r-qxgx-jq2v.json
CWE IDs: ["CWE-200", "CWE-918"]
Alternative ID: GHSA-p36r-qxgx-jq2v
Finding: F100
Auto approve: 1