CVE-2024-11603

🗓️ 20 Mar 2025 10:10:02Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 43 Views🌐 WEB

Server-Side Request Forgery vulnerability in fastchat version 0.2.36 exposes sensitive data risks.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-11603	20 Mar 202515:18	–	circl
CNNVD	FastChat 代码问题漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-11603 Server-Side Request Forgery in lm-sys/fastchat	20 Mar 202510:10	–	cvelist
EUVD	EUVD-2025-7033	3 Oct 202520:07	–	euvd
Github Security Blog	FastChat Server-Side Request Forgery vulnerability	20 Mar 202512:32	–	github
NVD	CVE-2024-11603	20 Mar 202510:15	–	nvd
OSV	GHSA-H254-G997-685C FastChat Server-Side Request Forgery vulnerability	20 Mar 202512:32	–	osv
RedhatCVE	CVE-2024-11603	22 Mar 202511:39	–	redhatcve
Snyk	Server-side Request Forgery (SSRF)	20 Mar 202512:32	–	snyk
vulnersOsv	agentverse (=0.1.8.1), airoboros (=2.1.1) +35 more potentially affected by CVE-2024-11603 via fschat (>=0.2.2 <=0.2.36)	20 Mar 202512:32	–	vulnersosv

NVD

Node

lm-sys fastchatMatch0.2.36

[
  {
    "vendor": "lm-sys",
    "product": "lm-sys/fastchat",
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "versionType": "custom",
        "lessThanOrEqual": "latest"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/89f1158d-4a75-4000-a1bd-f82dd1a62bff

Parameter	Position	Path	Description	CWE
path	query param	/queue/join?	Server-Side Request Forgery via insufficient validation of the path parameter on the /queue/join endpoint	CWE-918

29 Jul 2025 19:36Current

7.5High risk

Vulners AI Score7.5

CVSS 37.5

EPSS0.00253

SSVC

CWE-918