CVE-2024-37895

2024-06-1720:15:13

CWE-200

[email protected]

web.nvd.nist.gov

lobe chat

open-source

backend api key

sso/access code

authentication

vulnerability

upgrade

5.7 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.1%

JSON

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Vulners

Node

lobehublobe_chatRange<0.162.25

CNA Affected

[
  {
    "vendor": "lobehub",
    "product": "lobe-chat",
    "versions": [
      {
        "version": "< 0.162.25",
        "status": "affected"
      }
    ]
  }
]