Michael Koppmann

The web application does not protect its user authentication process against brute-force attacks, which are trial-and-error methods used to guess login credentials.

The web application contains a stored cross-site scripting (XSS) flaw within the custom attributes function. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

The web application contains a stored cross-site scripting (XSS) flaw within the datastore upload function. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

The web application contains a stored cross-site scripting (XSS) flaw within the assets function. Stored XSS occurs when an application receives data from a user and includes that data within its later HTTP responses in an unsafe way, allowing a malicious script to be permanently stored on the server.

The logout functionality is ineffective, allowing stolen session cookies to be misused for an extended period.

The web application fails to protect its Multi-Factor Authentication (MFA) validation process against brute-force attacks, which occur when an attacker systematically tries all possible combinations of a password or code until the correct one is found.

A logged-in user can obtain a JWT (JSON Web Token) for both the LibreChat API and the RAG API. This allows access to both APIs with the user's credentials. The JWT token can be abused.

LibreChat version 0.8.1-rc2 utilizes the same JWT secret for both the user session mechanism and the RAG API, which compromises the service-level authentication of the RAG API. This shared secret creates a security issue where authentication for the RAG API is vulnerable due to the reuse of the JWT secret. The RAG API is an endpoint used for Retrieval-Augmented Generation, a technique used to enhance the capabilities of large language models. JWT (JSON Web Token) is a standard for securely transmitting information between parties as a JSON object.