PT-2024-25011

CVE-2024-32964

تاريخ النشر

2024-05-10

تاريخ التحديث

2025-09-30

الوصف من

CVSS 3.1

9.0

حرجة

المقاييسAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 0.150.6

Description The issue is related to an unauthorized Server-Side Request Forgery (SSRF) vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The vulnerability can be exploited by providing external malicious URLs that redirect to internal resources. All users will be impacted.

Recommendations For versions prior to 0.150.6, consider the following:

Disable redirects in the /api/proxy endpoint to prevent SSRF attacks.
If redirects support is required, perform a check before each HTTP request to ensure the request is not being redirected to an internal resource. As a temporary workaround, consider restricting access to the /api/proxy endpoint until a patch is available.

قابلية الاستغلال

استغلال

إصلاح

التأثيرات

الباحثون

المورّدون

المنتجات المتأثرة

تصنيف نقاط الضعف

CWE-918: Server-Side Request Forgery (SSRF)

المعرّفات ذات الصلة

CVE-2024-32964

GHSA-3FC8-2R3F-8WRG