CVE-2024-37895

2024-06-1720:15:13

CWE-200

GitHub_M

web.nvd.nist.gov

lobe chat

open-source

backend api key

sso/access code

authentication

vulnerability

upgrade

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS

Percentile

9.0%

JSON

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issue has been addressed in version 0.162.25. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected configurations

Vulners

Node

lobehublobe_chatRange<0.162.25

VendorProductVersionCPE
lobehublobe_chat*cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lobehub	lobe_chat	*	cpe:2.3:a:lobehub:lobe_chat::::::::

CNA Affected

[
  {
    "vendor": "lobehub",
    "product": "lobe-chat",
    "versions": [
      {
        "version": "< 0.162.25",
        "status": "affected"
      }
    ]
  }
]