SSRF in Lobehub Lobe-Chat

CVE-2024-32965

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L.

EPSS exploit prediction

EPSS: 0.279 (98.0th percentile), scored .

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-32965: rose from 0.239 to 0.279.

EPSS over last 30 days · oldest: 0.239 · newest: 0.279 · change: +0.040

Affected products

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2024-32965?
CVE-2024-32965 is a high-severity vulnerability in Lobehub Lobe-Chat, classified under Server-Side Request Forgery (SSRF). CVSS score: 8.1/10. Published 2024-11-26.
How severe is CVE-2024-32965?
High severity. CVSS v3 base score is 8.1 out of 10.