CVE-2024-37895: Lobe Chat API key leak via base URL manipulation

CVE-2024-37895 · Severity: low · CVSS 3.1 · Published 2024-06-17

Lobe Chat is an open-source conversational AI platform. An authenticated attacker can steal backend API credentials by changing the base URL setting to point to an attacker-controlled server and intercepting the API key from request headers. This allows an attacker with valid user credentials to obtain secrets needed to directly access the backend API, potentially enabling unauthorized AI service usage or data exfiltration.

Technologies: @lobehub/chat (npm). Vendors: npm.

Quick answers

Is CVE-2024-37895 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-37895 being exploited in the wild.
How severe is CVE-2024-37895?
Low severity, with a CVSS score of 3.1, published 17 June 2024.
Which products and versions are affected?
@lobehub/chat (npm) SEMVER:introduced=0,fixed=0.162.25.
Is there a fix for CVE-2024-37895?
Yes. @lobehub/chat (npm): upgrade to 0.162.25 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-37895 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2024-37895?
Check whether you run @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @lobehub/chat (npm): upgrade to 0.162.25 or later
    npm install @lobehub/chat@0.162.25

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) coupled with credential exposure (CWE-918, CWE-200). Lobe Chat permits authenticated users to modify the backend base URL without validating or restricting outbound destinations. When a user configures a malicious URL and triggers a server-side request, the backend leaks its API key in request headers sent to the attacker's controlled server. The attack requires prior SSO/Access Code authentication and user interaction to change the configuration. No outbound traffic whitelist is implemented. The vulnerability affects all community versions up to 0.162.24; a patch is available in 0.162.25.

Affected products

  • Lobe Hub Lobe Chat <=0.162.24

Identifiers

  • CVE-2024-37895
  • GHSA-p36r-qxgx-jq2v

Timeline

  • 2024-06-17: disclosed: GHSA-p36r-qxgx-jq2v published
  • 2024-06-17: patched: Fix released in version 0.162.25

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.