CVE-2024-32964 PoC — Lobe Chat 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32964.yaml

Associated Vulnerability

Title:Lobe Chat 安全漏洞 (CVE-2024-32964)
Description:Lobe Chat是一个开源、高性能的聊天机器人框架。 Lobe Chat 0.150.6之前版本存在安全漏洞，该漏洞源于存在未经授权的服务器端请求伪造漏洞，攻击者无需登录即可构造恶意请求导致服务器端请求伪造和泄露敏感信息。

Description

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

File Snapshot


 id: CVE-2024-32964

info:
  name: Lobe Chat <= v0.150.5 - Server-Side Request Forgery
  author: s4e-

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!