Is CVE-2024-24566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-24566 being exploited in the wild.

How severe is CVE-2024-24566?

Low severity, with a CVSS score of 3.1, published 31 January 2024.

Which products and versions are affected?

LobeHub Lobe Chat up to 0.122.3; @lobehub/chat (npm) SEMVER:introduced=0,fixed=0.122.4.

Is there a fix for CVE-2024-24566?

Yes. @lobehub/chat (npm): upgrade to 0.122.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-24566 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-24566?

Check whether you run LobeHub Lobe Chat or @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-24566: LobeHub Lobe Chat authentication bypass in plugin gateway

CVE-2024-24566 · Severity: low · CVSS 3.1 · Published 2024-01-31

Lobe Chat is an open-source chat application that can be deployed with password protection to control access. A vulnerability allows attackers to bypass this password protection and directly invoke chat plugins through the `/api/plugin/gateway` endpoint without entering the required access code. This enables unauthorized users to interact with integrated services and potentially access sensitive functionality that should be restricted.

Technologies: LobeHub Lobe Chat, @lobehub/chat (npm). Vendors: LobeHub, npm.

Quick answers

Is CVE-2024-24566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-24566 being exploited in the wild.
How severe is CVE-2024-24566?: Low severity, with a CVSS score of 3.1, published 31 January 2024.
Which products and versions are affected?: LobeHub Lobe Chat up to 0.122.3; @lobehub/chat (npm) SEMVER:introduced=0,fixed=0.122.4.
Is there a fix for CVE-2024-24566?: Yes. @lobehub/chat (npm): upgrade to 0.122.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-24566 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-24566?: Check whether you run LobeHub Lobe Chat or @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@lobehub/chat (npm): upgrade to 0.122.4 or later
```
npm install @lobehub/chat@0.122.4
```

Technical details

The vulnerability is an improper access control flaw (CWE-284) in Lobe Chat versions up to 0.122.3. When the application is deployed with the ACCESS_CODE environment variable to enable password protection, the authentication check is not enforced on the `/api/plugin/gateway` API endpoint. An unauthenticated attacker can craft HTTP POST requests directly to this endpoint and invoke any available plugin (such as WeatherGPT) without providing the required access code. The attack requires only network access and no user interaction. The fix, available in version 0.122.4, adds proper ACCESS_CODE verification to the plugin gateway route.

Affected products

LobeHub Lobe Chat up to 0.122.3

Identifiers

CVE-2024-24566
GHSA-pf55-fj96-xf37

Timeline

2024-01-31: disclosed: Advisory published
2024-01-31: patched: Fix released in version 0.122.4

References

https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.