CVE-2024-32965: @lobehub/chat Server Side Request Forgery vulnerability

November 26, 2024

lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.

References

github.com/advisories/GHSA-2xcc-vm3f-m8rw
github.com/lobehub/lobe-chat
github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf
github.com/lobehub/lobe-chat/security/advisories/GHSA-2xcc-vm3f-m8rw
nvd.nist.gov/vuln/detail/CVE-2024-32965

Code Behaviors & Features

Detect and mitigate CVE-2024-32965 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →