CVE-2024-32965
Description
Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
How to fix
- lobehub lobe_chat1.19.13 or later
- @lobehub/chat1.19.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lobehub lobe_chat | v < 1.19.13 | 1.19.13 |
| @lobehub/chatnpm | v < 1.19.13 | 1.19.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.