{"id":"CVE-2024-47066","published":"2024-09-23T15:17:43Z","modified":"2024-09-23T15:41:22Z","title":"Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)","vendor":"lobehub","product":"lobe-chat","tier":"tail","description":{"text":"Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.1186,"percentile":0.96091,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-3fc8-2r3f-8wrg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc","tags":["x_refsource_MISC"]},{"url":"https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf","tags":["x_refsource_MISC"]},{"url":"https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts","tags":["x_refsource_MISC"]}],"priority":{"score":30.5,"factors":[{"name":"EPSS percentile","points":19.22},{"name":"Public exploit code","points":5.0},{"name":"CVSS severity","points":6.3}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-09-25","earliestUrl":"https://github.com/EQSTLab/CVE-2024-47066","repos":[{"name":"EQSTLab/CVE-2024-47066","url":"https://github.com/EQSTLab/CVE-2024-47066","stars":0,"created":"2024-09-25"}]},"first":{"date":"2024-09-25","source":"PoC-in-GitHub","url":"https://github.com/EQSTLab/CVE-2024-47066"},"provenance":"source"},"vendorSlug":"lobehub","affectedVersions":[{"vendor":"lobehub","product":"lobe-chat","versions":["< 1.19.13"]}],"affected":[{"ecosystem":"npm","package":"@lobehub/chat","vulnerableRanges":["<1.19.13"],"patched":["1.19.13"],"from":["GHSA-3fc8-2r3f-8wrg"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2703","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-lobehub-lobe-chat-cve-2024-32964","parents":[{"from":"CVE-2024-32964","to":"CVE-2024-47066","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-mxhq-xw3g-rphc","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-3fc8-2r3f-8wrg","via":"reference","url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"},{"kind":"same-code","provenance":"machine","files":["src/app/api/proxy/route.ts"],"commits":["https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37","https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf"],"basis":"rarely changed file"}]}]}}