CVE-2024-32964: lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

May 10, 2024

The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.

References

github.com/advisories/GHSA-mxhq-xw3g-rphc
github.com/lobehub/lobe-chat
github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc
nvd.nist.gov/vuln/detail/CVE-2024-32964

Code Behaviors & Features

Detect and mitigate CVE-2024-32964 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →