Lucene search

GitHub_MVULNRICHMENT:CVE-2024-37895

HistoryJun 17, 2024 - 7:28 p.m.

CVE-2024-37895 API Key Leak in lobe-chat

2024-06-1719:28:31

CWE-200

GitHub_M

github.com

api key

lobe-chat

sso authentication

vulnerability

upgrade

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CNA Affected

[
  {
    "vendor": "lobehub",
    "product": "lobe-chat",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.162.25"
      }
    ]
  }
]

References

github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-37895