Description
SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like private network or loopback address.
Recommendation
Update the @lobehub/chat package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.19.12
- Patched version(s): 1.19.13
References
Could your website be exposed too?
SmartScanner can check your website for lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability - CVE-2024-32964
- Lobe Chat API Key Leak - CVE-2024-37895
- @lobehub/chat Server Side Request Forgery vulnerability - CVE-2024-32965
- Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion - CVE-2026-23522
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2024