Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 1.19.13. It is, therefore, affected by multiples Server-Side Request Forgery :

 - A Server-Side Request Forgery through proxy address

 - A Server-Side Request Forgery through through a bypass of a previous fix

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an
    unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without
    logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-
    Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target
    lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised
    to upgrade. There are no known workarounds for this vulnerability. (CVE-2024-32965)

ID	Name	Product	Family	Severity
114586	LobeChat < 1.19.13 Server-Side Request Forgery	Web App Scanning	Artificial Intelligence	high
409167	SCA: security update for @lobehub/chat (GHSA-2xcc-vm3f-m8rw)	Tenable Cloud Security	SCA Checks	high
409167	SCA: security update for @lobehub/chat (GHSA-2xcc-vm3f-m8rw)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2024-32965

high

Tenable Plugins

high

high

high