Executive brief
Lobe Chat is an AI chat application with a built-in web crawling feature that allows the server to fetch and process content from URLs. A flaw in the web crawler fails to validate or restrict outbound HTTP requests, allowing authenticated attackers to make the server request internal resources like localhost APIs, private networks, and cloud metadata endpoints. This could lead to unauthorized access to internal system information, leaked credentials, and lateral movement within a network.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the tRPC endpoint tools.search.crawlPages. When a client supplies an array of URLs and specifies the "naive" implementation, the server performs unfiltered HTTP requests to those URLs without validating against private IP ranges (127.0.0.1, localhost, 10.0.0.0/8, etc.) or cloud metadata endpoints (169.254.169.254). The vulnerable code path flows through the tRPC router → Crawler.crawl → naive implementation's fetch(url), which executes the request as-is. While production deployments require valid authentication tokens, the vulnerability can be exploited in dev environments by bypassing auth via the lobe-auth-dev-backend-api header. An attacker can retrieve responses from internal APIs and metadata servers, potentially exposing credentials, configuration, and system state. The fix is available in version 1.136.2 and later.
Affected products
- LobeHub Lobe Chat <= 1.136.1
Timeline
- 2025-10-17: disclosed
- 2025-10-17: patched: Fixed in version 1.136.2