Server-side Request Forgery (SSRF) Affecting @lobehub/chat package, versions <0.162.25
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-LOBEHUBCHAT-7268382
- published 19 Jun 2024
- disclosed 17 Jun 2024
- credit zhuozhiyongde
Introduced: 17 Jun 2024
CVE-2024-37895 Open this link in a new tabHow to fix?
Upgrade @lobehub/chat to version 0.162.25 or higher.
Overview
@lobehub/chat is a Lobe Chat - an open-source, high-performance chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the base URL configuration, which can expose the backend API key to an attacker-controlled domain as outbound traffic is not filtered on URL. The API key can subsequently be used for unauthorized access to the vulnerable server.