CVE-2024-32964 in the critical feed json
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
published 2024-05-10 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-1699 , GHSA-mxhq-xw3g-rphc
- cvss
- 9.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 53.0%
- EPSS 53.0% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
52.96% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Lobe Chat <= v0.150.5 - Server-Side Request Forgery nuclei detection template
- github.com https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H |
| GitHub | 3.1 | 9.0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @lobehub/chat | <0.150.6 |
0.150.6 |
Affected products
- lobehub lobe-chat
- lobehub lobe_chat
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37
web, patch
-
github.com
/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-32964
advisory
-
github.com
/lobehub/lobe-chat
package
Sources
- CVE List CVE-2024-32964
- GitHub Advisory GHSA-mxhq-xw3g-rphc
- NVD CVE-2024-32964
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.