CVE-2024-32964 in the critical feed json
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
published 2y ago modified 4mo ago also EUVD-2024-1699 , GHSA-mxhq-xw3g-rphc
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.0%
- EPSS 53.0% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known
Summary
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.
Patch / fix
Is CVE-2024-32964 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2y ago
Exploit prediction
52.96% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- github.com https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @lobehub/chat | <0.150.6 |
0.150.6 |
Affected products
- lobehub lobe-chat
- lobehub lobe_chat
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37
web, patch
-
github.com
/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-32964
advisory
-
github.com
/lobehub/lobe-chat
package
Sources
- CVE List CVE-2024-32964
- GitHub Advisory GHSA-mxhq-xw3g-rphc
- NVD CVE-2024-32964
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.