Vulnerability library
Security checkMay 14, 2024

lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

High severitynpm@lobehub/chat

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.

Recommendation

Update the @lobehub/chat package to the latest compatible version. Followings are version details:

  • Affected version(s): <= 0.150.5
  • Patched version(s): 0.150.6

References

Could your website be exposed too?

SmartScanner can check your website for lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated May 14, 2024