CVE-2024-47066 PoC — Lobe Chat 代码问题漏洞

Source

https://github.com/l8BL/CVE-2024-47066

Associated Vulnerability

Title:Lobe Chat 代码问题漏洞 (CVE-2024-47066)
Description:Lobe Chat是LobeHub开源的一个开源、高性能的聊天机器人框架。 Lobe Chat 1.19.13版本之前存在代码问题漏洞，该漏洞源于src/app/api/proxy/route.ts中实现的服务器端请求伪造保护不考虑重定向，当攻击者提供重定向到内部资源（如私有网络或环回地址）的外部恶意 URL 时，可能会被绕过。

Description

Proof-of-Concept for CVE-2024-47066

Readme

# CVE-2024-47066
★ CVE-2024-47066 LobeChat SSRF PoC ★


## Description
**CVE-2024-47066** : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.


**Reporter**: [a1loy](https://github.com/a1loy)


## How to use

### Git clone
```
git clone https://github.com/l8BL/CVE-2024-47066.git
cd CVE-2024-47066
```
### Setup Vulnerable Environment
```sh
cd docker
docker-compose up -d
```


(External) LodeChat --> **SSRF ATTACK** --> (Internal) http://www.internal-service:4000


### Install packages 
```sh
pip install -r requirements.txt
```
### Command
```sh
python3 CVE-2024-47066.py -v <URL_TO_EXPLOIT> -i <URL_TO_REQUEST>
```

### Example 
```sh
python3 CVE-2024-47066.py -v http://localhost:3210 -i http://www.internal-service:4000
```

### Output
**CVE-2024-47066**
![alt text](./assets/1.png)


### Result
![alt text](./assets/2.png)


# Attack Scenario

## Steal EC2 Metadata Credentials 
Make Request to http://169.254.169.254

# Disclaimer
This repository is not intended to be SSRF exploit to CVE-2024-47066. The purpose of this project is to help people learn about this vulnerability, and perhaps test their own applications.

# Reference
https://github.com/advisories/GHSA-3fc8-2r3f-8wrg

File Snapshot


 [4.0K]  /data/pocs/699c63d350f089df3e0b9def4519e62f56c2c22a
├── [4.0K]  assets
│   ├── [ 30K]  1.png
│   ├── [ 40K]  299.png
│   └── [ 13K]  2.png
├── [8.5K]  CVE-2024-47066.py
├── [4.0K]  docker
│   ├── [4.0K]  app
│   │   ├── [ 349]  app.py
│   │   ├── [ 260]  Dockerfile
│   │   ├── [  15]  flag.txt
│   │   └── [  12]  requirements.txt
│   └── [ 228]  docker-compose.yml
├── [1.5K]  README.md
└── [  19]  requirements.txt

3 directories, 11 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!