CVE-2024-47066

CVE-2024-47066 (Lobe Chat) is an SSRF issue in Lobe Chat prior to version 1.19.13 where server-side proxy protection in src/app/api/proxy/route.ts does not handle redirects, allowing an attacker-supplied URL to redirect to internal resources (e.g., private networks or loopback). The vulnerability...

CVE-2024-32964

Summary of the CVE-2024-32964 family (Lobe Chat) : A Server-Side Request Forgery vulnerability was reported in Lobe Chat prior to version 0.150.6, targeting the /api/proxy endpoint. Connected sources consistently describe an unauthenticated SSRF where an attacker can persuade the server to fetch ...