{"id":"CVE-2024-32964","published":"2024-05-10T14:49:31Z","modified":"2024-08-02T02:27:53Z","title":"lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability","vendor":"lobehub","product":"lobe-chat","tier":"tail","description":{"text":"Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.","provenance":"source","from":"CVE.org"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.52964,"percentile":0.98975,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37","tags":["x_refsource_MISC"]}],"priority":{"score":31.1,"factors":[{"name":"EPSS percentile","points":19.8},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.3}]},"exploitSources":{"nuclei":[{"id":"CVE-2024-32964","name":"Lobe Chat <= v0.150.5 - Server-Side Request Forgery","severity":"critical","path":"http/cves/2024/CVE-2024-32964.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32964.yaml"}],"provenance":"source"},"vendorSlug":"lobehub","affectedVersions":[{"vendor":"lobehub","product":"lobe-chat","versions":["<= 0.150.5"]}],"affected":[{"ecosystem":"npm","package":"@lobehub/chat","vulnerableRanges":["<0.150.6"],"patched":["0.150.6"],"from":["GHSA-mxhq-xw3g-rphc"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-1699","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-lobehub-lobe-chat-cve-2024-32964","children":[{"from":"CVE-2024-32964","to":"CVE-2024-47066","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-mxhq-xw3g-rphc","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-3fc8-2r3f-8wrg","via":"reference","url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"},{"kind":"same-code","provenance":"machine","files":["src/app/api/proxy/route.ts"],"commits":["https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37","https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf"],"basis":"rarely changed file"}]},{"from":"CVE-2024-32964","to":"CVE-2024-32965","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/app/api/proxy/route.ts"],"commits":["https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37","https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf"],"basis":"rarely changed file"}]}]}}